Remove autoscan ITs and add withoutSemantic tests #3420
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - branch-* | |
| - dogfood-* | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "30 1 * * 1-5" # Run Mon-Fri at 1:30 AM UTC | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| USE_DEVELOCITY: true | |
| DEVELOCITY_URL: https://develocity.sonar.build/ | |
| MAVEN_OUTPUT_ARGS: "--errors --show-version" | |
| jobs: | |
| build: | |
| runs-on: sonar-m-public | |
| name: Build | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| outputs: | |
| build-number: ${{ steps.build-maven.outputs.BUILD_NUMBER }} | |
| deployed: ${{ steps.build-maven.outputs.deployed }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - uses: SonarSource/ci-github-actions/build-maven@v1 | |
| id: build-maven | |
| env: | |
| MAVEN_OPTS: "-Xmx8g" | |
| with: | |
| deploy-pull-request: true | |
| sonar-platform: none # Prevent analysis | |
| # Override artifactory roles for public repo using private access | |
| artifactory-reader-role: private-reader | |
| artifactory-deployer-role: qa-deployer | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| maven-args: > | |
| --define maven.test.skip=true | |
| --define sonar.skip=true | |
| --projects !java-checks-test-sources/aws,!java-checks-test-sources/default,!java-checks-test-sources/java-17,!java-checks-test-sources/spring-3.2,!java-checks-test-sources/spring-web-4.0 | |
| ruling-qa: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| item: | |
| - { runner: sonar-m-public, profile: without-sonarqube-project, sq_version: LATEST_RELEASE } | |
| - { runner: sonar-m-public, profile: only-sonarqube-project, sq_version: LATEST_RELEASE } | |
| - { runner: github-windows-latest-m, profile: without-sonarqube-project, sq_version: LATEST_RELEASE } | |
| - { runner: github-windows-latest-m, profile: only-sonarqube-project, sq_version: LATEST_RELEASE } | |
| name: Ruling QA | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: ${{ matrix.item.runner }} | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: recursive | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - name: Select Java Version | |
| shell: bash # Set explicitly so Bash is used on Windows runners too. | |
| run: | | |
| mise use java@21 | |
| JAVA_21_HOME="$(mise where java@21)" | |
| echo "JAVA_HOME=${JAVA_21_HOME}" >> "$GITHUB_ENV" | |
| echo "${JAVA_21_HOME}/bin" >> "$GITHUB_PATH" | |
| - name: Ensure Separate Job Cache Key | |
| uses: ./.github/actions/write-file | |
| with: | |
| file-path: target/just_for_cache_key_calculation/pom.xml | |
| content: ${{ github.job }}-${{ toJSON(matrix.item) }} | |
| - name: Configure Maven | |
| uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| - name: Getting Vault Secrets | |
| id: secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/github/token/licenses-ro token | GITHUB_TOKEN; | |
| - name: Orchestrator Cache | |
| uses: ./.github/actions/orchestrator-cache | |
| with: | |
| sq-version: ${{ matrix.item.sq_version }} | |
| - name: Run ruling tests | |
| shell: bash # Set explicitly so Bash is used on Windows runners too. | |
| env: | |
| MAVEN_OPTS: "-Xmx3g" | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }} | |
| run: | | |
| cd its/ruling | |
| mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false -Dparallel=methods -DuseUnlimitedThreads=true | |
| - name: Upload Actual Results On Failure | |
| if: failure() | |
| uses: ./.github/actions/upload-actual | |
| with: | |
| name: ${{ matrix.item.runner }}_${{ matrix.item.profile }} | |
| it-dir: its/ruling | |
| expected-dir: src/test/resources | |
| actual-dir: target/actual | |
| ruling-update-notify: | |
| name: Ruling Update and Notify | |
| needs: ruling-qa | |
| if: always() && github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| submodules: recursive | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: true | |
| - name: Check ruling-qa results | |
| id: check-ruling | |
| run: | | |
| # Check if any ruling-qa job failed | |
| # For matrix jobs, needs.ruling-qa.result can be 'success' only if ALL jobs succeeded | |
| RULING_FAILED=false | |
| if [[ "${{ needs.ruling-qa.result }}" != "success" ]]; then | |
| RULING_FAILED=true | |
| fi | |
| echo "ruling-failed=$RULING_FAILED" >> "$GITHUB_OUTPUT" | |
| echo "Ruling QA result: ${{ needs.ruling-qa.result }}, failed=$RULING_FAILED" | |
| - name: Update ruling and notify | |
| uses: SonarSource/core-languages-tooling-public/ruling-update-and-notify@master | |
| with: | |
| pr-number: ${{ github.event.pull_request.number }} | |
| ruling-failed: ${{ steps.check-ruling.outputs.ruling-failed }} | |
| ruling-root: 'its/ruling/src/test/resources' | |
| sources-root: 'its/sources' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| plugin-qa: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sq_version: ['LATEST_RELEASE', 'DEV'] | |
| is_nightly: | |
| - ${{ github.event_name == 'schedule' }} | |
| exclude: | |
| - sq_version: DEV | |
| is_nightly: false | |
| name: Plugin QA | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: sonar-m-public | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: recursive | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - name: Select Java Version | |
| shell: bash # Set explicitly so Bash is used on Windows runners too. | |
| run: | | |
| mise use java@21 | |
| JAVA_21_HOME="$(mise where java@21)" | |
| echo "JAVA_HOME=${JAVA_21_HOME}" >> "$GITHUB_ENV" | |
| echo "${JAVA_21_HOME}/bin" >> "$GITHUB_PATH" | |
| - name: Ensure Separate Job Cache Key | |
| uses: ./.github/actions/write-file | |
| with: | |
| file-path: target/just_for_cache_key_calculation/pom.xml | |
| content: ${{ github.job }}-${{ matrix.sq_version }} | |
| - name: Configure Maven | |
| uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| - name: Getting Vault Secrets | |
| id: secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/github/token/licenses-ro token | GITHUB_TOKEN; | |
| - name: Orchestrator Cache | |
| uses: ./.github/actions/orchestrator-cache | |
| with: | |
| sq-version: ${{ matrix.sq_version }} | |
| - name: Plugin QA | |
| env: | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }} | |
| run: | | |
| cd its/plugin | |
| mvn package ${MAVEN_OUTPUT_ARGS} -Pit-plugin -Dsonar.runtimeVersion=${{ matrix.sq_version }} -Dmaven.test.redirectTestOutputToFile=false -Dparallel=classes -DuseUnlimitedThreads=true | |
| sanity: | |
| name: Sanity Test | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: sonar-m-public | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - uses: SonarSource/vault-action-wrapper@v3 | |
| id: secrets | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_HOST_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| - name: Ensure Separate Job Cache Key | |
| uses: ./.github/actions/write-file | |
| with: | |
| file-path: target/just_for_cache_key_calculation/pom.xml | |
| content: ${{ github.job }} | |
| - uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| - name: Compile Test Sources | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| working-directory: java-checks-test-sources | |
| run: | | |
| mvn clean compile --batch-mode | |
| - name: Sanity Test | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| MAVEN_OPTS: "-Xmx8g" | |
| run: | | |
| mvn verify ${MAVEN_OUTPUT_ARGS} -f sonar-java-plugin/pom.xml -Psanity -Dtest=SanityTest | |
| test-analyze: | |
| name: Test Analyze | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: sonar-l-public | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - uses: SonarSource/vault-action-wrapper@v3 | |
| id: secrets | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_HOST_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| - uses: SonarSource/ci-github-actions/build-maven@v1 | |
| with: | |
| deploy: false | |
| artifactory-reader-role: private-reader # Override default public-reader | |
| artifactory-deployer-role: qa-deployer # Override default public-deployer | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| scanner-java-opts: '-Xmx2g' | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| JAVA_TOOL_OPTIONS: "" # Set an empty value to avoid issues with runners hanging and significantly slowing down builds | |
| custom-rules-license-check: | |
| name: Custom Rules and License Check | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: sonar-m-public | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - uses: SonarSource/vault-action-wrapper@v3 | |
| id: secrets | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_HOST_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| - name: Ensure Separate Job Cache Key | |
| uses: ./.github/actions/write-file | |
| with: | |
| file-path: target/just_for_cache_key_calculation/pom.xml | |
| content: ${{ github.job }} | |
| - uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| JAVA_TOOL_OPTIONS: "" # Set an empty value to avoid issues with runners hanging and significantly slowing down builds | |
| - name: Build Java Custom Rules Example | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| working-directory: docs/java-custom-rules-example | |
| run: | | |
| mvn clean package -f pom_SQ_10_6_LATEST.xml --batch-mode | |
| - name: Check License Compliance | |
| run: | | |
| # See https://xtranet.sonarsource.com/display/DEV/Open+Source+Licenses | |
| mvn org.codehaus.mojo:license-maven-plugin:aggregate-add-third-party \ | |
| --batch-mode \ | |
| "-Dlicense.missingFile=${PWD}/missing-dep-licenses.properties" \ | |
| -DuseMissingFile \ | |
| "-Dlicense.overrideUrl=file://${PWD}/override-dep-licenses.properties" | |
| qa-os-win: | |
| name: Build and Unit Test on Windows | |
| # No dependency on build step, because we do not need the build number. | |
| runs-on: github-windows-latest-m | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| steps: | |
| - name: Config Git | |
| run: git config --global core.autocrlf input | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| version: 2026.7.18 | |
| - name: Ensure Separate Job Cache Key | |
| uses: ./.github/actions/write-file | |
| with: | |
| file-path: target/just_for_cache_key_calculation/pom.xml | |
| content: ${{ github.job }} | |
| - name: Configure Maven | |
| uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| use-develocity: ${{ env.USE_DEVELOCITY }} | |
| develocity-url: ${{ env.DEVELOCITY_URL }} | |
| - name: Run Maven | |
| run: mvn clean verify --batch-mode | |
| promote: | |
| needs: | |
| - build | |
| - ruling-qa | |
| - plugin-qa | |
| - sanity | |
| - test-analyze | |
| - custom-rules-license-check | |
| - qa-os-win | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: sonar-s-public | |
| name: Promote | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: SonarSource/ci-github-actions/promote@v1 | |
| with: | |
| promote-pull-request: true |