Add SonarQube analysis - #25
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 006be3327b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| registry-token: ${{ secrets.REGISTRY_TOKEN }} | ||
|
|
||
| sonar: | ||
| needs: tests |
There was a problem hiding this comment.
On pushes to main or development, when SonarQube or its Quality Gate fails, this dependency only orders sonar after tests; build-api and build-migrator still depend directly on tests, so they can publish both images and allow notify to run without waiting for the failed analysis. Add sonar to the build dependency chain so the new quality gate actually blocks release artifacts.
AGENTS.md reference: .github/workflows/AGENTS.md:L1-L1
Useful? React with 👍 / 👎.
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Что изменено
dotnet-sonar.yml@main;build-apiиbuild-migratorтеперь зависят от успешногоsonarи не публикуют release images при провале анализа или Quality Gate;TestcontainersиTestcontainers.PostgreSqlобновлены с 4.12.0 до 4.14.0 для устранения транзитивной уязвимостиSSH.NET.Зачем
Подключить репозиторий к централизованному SonarQube-анализу и сделать Quality Gate обязательным условием публикации release-артефактов.
Проверка
actionlint .github/workflows/ci.yml;tests, затем проверитьsonarи Quality Gate в PR;mainилиdevelopmentубедиться, что image jobs запускаются только после успешногоsonar.Миграций, изменений публичных контрактов и breaking changes нет. Изменена конфигурация GitHub Actions; новые secrets или variables не требуются.