pullrequest.yml

# This workflow uses several third-party actions to perform code scans and quality analyses for PRs.


name: Run sonar scan and quality checks for pull requests

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  apiSonarCloud:
    name: Api SonarCloud Analysis
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./packages/api
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK 11
        uses: actions/setup-java@v1
        with:
          java-version: 11
      - name: Cache SonarCloud packages
        uses: actions/cache@v1
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Cache Maven packages
        uses: actions/cache@v1
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2
      - name: Build and analyze
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: >
          mvn verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
          -B
          -q
          -Dsonar.projectName=osahft_monorepo_api
          -Dsonar.projectKey=osahft_monorepo_api
          -Dsonar.qualitygate.wait=true
          -DskipTests=true

  appSonarCloud:
    name: App SonarCloud Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        with:
          projectBaseDir: ./packages/app
          args: >
            -Dsonar.organization=osahft
            -Dsonar.projectKey=osahft_monorepo_app
            -Dsonar.sources=src/
            -Dsonar.qualitygate.wait=true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}