Skip to content

Commit 10b0aaf

Browse files
jvigliottajvigliotta
authored
Merge branch 'release/5.4.0' into omm-348
2 parents 0c733f7 + 310f7a5 commit 10b0aaf

File tree

2 files changed

+159
-0
lines changed

2 files changed

+159
-0
lines changed

‎.github/workflows/sonarcloud.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "SonarCloud and CodeQL"
13+
14+
on:
15+
push:
16+
branches: [ "main", "release/*" ]
17+
pull_request:
18+
branches: [ "main", "release/*" ]
19+
schedule:
20+
- cron: '43 6 * * 6'
21+
workflow_dispatch: {}
22+
23+
jobs:
24+
analyze:
25+
name: Analyze (${{ matrix.language }})
26+
# Runner size impacts CodeQL analysis time. To learn more, please see:
27+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
28+
# - https://gh.io/supported-runners-and-hardware-resources
29+
# - https://gh.io/using-larger-runners
30+
# Consider using larger runners for possible analysis time improvements.
31+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
32+
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
33+
permissions:
34+
# required for all workflows
35+
security-events: write
36+
37+
# only required for workflows in private repositories
38+
actions: read
39+
contents: read
40+
41+
strategy:
42+
fail-fast: false
43+
matrix:
44+
include:
45+
- language: javascript-typescript
46+
build-mode: none
47+
# CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
48+
# Use `c-cpp` to analyze code written in C, C++ or both
49+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
50+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
51+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
52+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
53+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
54+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
55+
steps:
56+
- name: Checkout repository
57+
uses: actions/checkout@v4
58+
with:
59+
fetch-depth: 0
60+
61+
# Initializes the CodeQL tools for scanning.
62+
- name: Initialize CodeQL
63+
uses: github/codeql-action/init@v3
64+
with:
65+
languages: ${{ matrix.language }}
66+
build-mode: ${{ matrix.build-mode }}
67+
queries: security-and-quality, security-extended
68+
# If you wish to specify custom queries, you can do so here or in a config file.
69+
# By default, queries listed here will override any specified in a config file.
70+
# Prefix the list here with "+" to use these queries and those in the config file.
71+
72+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
73+
# queries: security-extended,security-and-quality
74+
75+
# If the analyze step fails for one of the languages you are analyzing with
76+
# "We were unable to automatically build your code", modify the matrix above
77+
# to set the build mode to "manual" for that language. Then modify this step
78+
# to build your code.
79+
# ℹ️ Command-line programs to run using the OS shell.
80+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
81+
- if: matrix.build-mode == 'manual'
82+
run: |
83+
echo 'If you are using a "manual" build mode for one or more of the' \
84+
'languages you are analyzing, replace this with the commands to build' \
85+
'your code, for example:'
86+
echo ' make bootstrap'
87+
echo ' make release'
88+
exit 1
89+
90+
- name: Perform CodeQL Analysis
91+
uses: github/codeql-action/analyze@v3
92+
with:
93+
category: "/language:${{matrix.language}}"
94+
95+
# - name: Post-Process Output
96+
# run: |
97+
# ls -alt /home/runner/work/openmct-mcws/results
98+
# pip instal nasa-scrub
99+
100+
# results_dir=`realpath ${{ github.workspace }}/../results`
101+
# sarif_files=`find $results_dir -name '*.sarif'`
102+
103+
# for sarif_file in $sarif_files
104+
# do
105+
# output_file="$results_dir/$(basename $sarif_file .sarif)_stripped.sarif"
106+
107+
# python3 -m scrub.tools.parsers.translate_results $sarif_file $output_file ${{ github.workspace }} sarif
108+
# done
109+
110+
# python3 -m scrub.tools.parsers.csv_parser $results_dir
111+
112+
# echo "RESULTS_DIR=$results_dir" >> $GITHUB_ENV
113+
114+
- name: Post-Process Output
115+
run: |
116+
python3 -m pip install nasa-scrub
117+
118+
results_dir=`realpath ${{ github.workspace }}/../results`
119+
sarif_files=`find $results_dir -name '*.sarif'`
120+
121+
for sarif_file in $sarif_files
122+
do
123+
output_file="$results_dir/$(basename $sarif_file .sarif)_stripped.sarif"
124+
output_file_scrub="$results_dir/$(basename $sarif_file .sarif)_stripped.scrub"
125+
126+
python3 -m scrub.tools.parsers.translate_results $sarif_file $output_file ${{ github.workspace }} sarifv2.1.0
127+
# python3 -m scrub.tools.parsers.translate_results $sarif_file $output_file_scrub ${{ github.workspace }} scrub
128+
done
129+
130+
# python3 -m scrub.tools.parsers.csv_parser $results_dir
131+
132+
echo "RESULTS_DIR=$results_dir" >> $GITHUB_ENV
133+
134+
135+
- name: Upload Artifacts
136+
uses: actions/[email protected]
137+
with:
138+
name: codeql-artifacts
139+
path: ${{ env.RESULTS_DIR }}
140+
- name: SonarCloud Scan
141+
uses: SonarSource/sonarqube-scan-action@v5
142+
env:
143+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎sonar-project.properties‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
sonar.projectKey=NASA-AMMOS_openmct-mcws
2+
sonar.organization=nasa-ammos
3+
4+
# This is the name and version displayed in the SonarCloud UI.
5+
#sonar.projectName=openmct-mcws
6+
#sonar.projectVersion=1.0
7+
8+
9+
# Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
10+
#sonar.sources=.
11+
sonar.exclusions=**/pom.xml
12+
sonar.sarifReportPaths="/home/runner/work/openmct-mcws/results/javascript_stripped.sarif"
13+
sonar.log.level=TRACE
14+
15+
# Encoding of the source code. Default is default system encoding
16+
#sonar.sourceEncoding=UTF-8

0 commit comments

Comments
 (0)