Attest sonar wait flag (#507)

Author: FayeSGW

cmd/kosli/attestSonar.go

@@ -24,6 +24,7 @@ type attestSonarOptions struct {
 	projectKey string
 	serverURL  string
 	revision   string
+	maxWait    int
 	payload    SonarAttestationPayload
 }
 
@@ -34,19 +35,24 @@ Retrieves results for the specified scan from SonarQube Cloud or SonarQube Serve
 The results are parsed to find the status of the project's quality gate which is used to determine the attestation's compliance status.
 
 The scan to be retrieved can be specified in two ways:
-1. (Default) Using metadata created by the Sonar scanner. By default this is located within a temporary .scannerwork folder in the repo base directory.
+1. (Default) Using metadata created by the Sonar scanner. By default this is located within a temporary ^.scannerwork^ folder in the repo base directory.
 If you have overriden the location of this folder by passing parameters to the Sonar scanner, or are running Kosli's CLI locally outside the repo's base directory,
-you can provide the correct path using the --sonar-working-dir flag. This metadata is generated by a specific scan, allowing Kosli to retrieve the results of that scan.
+you can provide the correct path using the ^--sonar-working-dir^ flag. This metadata is generated by a specific scan, allowing Kosli to retrieve the results of that scan.  
+If there are delays in the scan processing (either because the scanned project is very large, or because SonarQube is experiencing processing delays), it may happen that 
+the scan results are not available by the time the attest sonar command is executed. In this case you can use the ^--max-wait^ flag to retry the command while waiting for the scan to be processed. 
+This flag takes the maximum number of seconds to wait for the results to be available. The Kosli CLI will then attempt to retrieve the scan results until the maximum wait time is reached, with 
+exponential backoff between retries. Once the results are available they are attested to Kosli as usual.
+
 2. Providing the Sonar project key and the revision of the scan (plus the SonarQube server URL if relevant). If running the Kosli CLI in some CI/CD pipeline, the revision
 is defaulted to the commit SHA. If you are running the command locally, or have overriden the revision in SonarQube via parameters to the Sonar scanner, you can
-provide the correct revision using the --sonar-revision flag. Kosli then finds the scan results for the specified project key and revision.
+provide the correct revision using the ^--sonar-revision^ flag. Kosli then finds the scan results for the specified project key and revision.
 
 Note that if your project is very large and you are using SonarQube Cloud's automatic analysis, it is possible for the attest sonar command to run before the SonarQube Cloud scan is completed.
 In this case, we recommend using Kosli's Sonar webhook integration ( https://docs.kosli.com/integrations/sonar/ ) rather than the CLI to attest the scan results.
 ` + attestationBindingDesc
 
 const attestSonarExample = `
-# report a SonarQube Cloud attestation about a trail using Sonar's metadata:
+# report a SonarQube Cloud attestation about a trail using SonarQube's metadata, with no retries:
 kosli attest sonar \
 	--name yourAttestationName \
 	--flow yourFlowName \
@@ -56,7 +62,7 @@ kosli attest sonar \
 	--api-token yourAPIToken \
 	--org yourOrgName \
 
-# report a SonarQube Server attestation about a trail using Sonar's metadata:
+# report a SonarQube Server attestation about a trail using SonarQube's metadata, waiting for up to 60 seconds for the results to be available:
 kosli attest sonar \
 	--name yourAttestationName \
 	--flow yourFlowName \
@@ -65,6 +71,7 @@ kosli attest sonar \
 	--sonar-working-dir yourSonarWorkingDirPath \
 	--api-token yourAPIToken \
 	--org yourOrgName \
+	--max-wait 60
 
 # report a SonarQube Cloud attestation for a specific branch about a trail using key/revision:
 kosli attest sonar \
@@ -91,7 +98,7 @@ kosli attest sonar \
 	--api-token yourAPIToken \
 	--org yourOrgName \
 
-# report a SonarQube Cloud attestation about a trail with an attachment using Sonar's metadata:
+# report a SonarQube Cloud attestation about a trail with an attachment using SonarQube's metadata, waiting for up to 300 seconds for the results to be available:
 kosli attest sonar \
 	--name yourAttestationName \
 	--flow yourFlowName \
@@ -100,7 +107,8 @@ kosli attest sonar \
 	--sonar-working-dir yourSonarWorkingDirPath \
 	--attachment yourAttachmentPath \
 	--api-token yourAPIToken \
-	--org yourOrgName
+	--org yourOrgName \
+	--max-wait 300
 `
 
 func newAttestSonarCmd(out io.Writer) *cobra.Command {
@@ -156,6 +164,7 @@ func newAttestSonarCmd(out io.Writer) *cobra.Command {
 	cmd.Flags().StringVar(&o.projectKey, "sonar-project-key", "", sonarProjectKeyFlag)
 	cmd.Flags().StringVar(&o.serverURL, "sonar-server-url", "https://sonarcloud.io", sonarServerURLFlag)
 	cmd.Flags().StringVar(&o.revision, "sonar-revision", o.commitSHA, sonarRevisionFlag)
+	cmd.Flags().IntVar(&o.maxWait, "max-wait", 30, sonarMaxWaitFlag)
 
 	err := RequireFlags(cmd, []string{"flow", "trail", "name", "sonar-api-token"})
 	if err != nil {
@@ -173,9 +182,9 @@ func (o *attestSonarOptions) run(args []string) error {
 		return err
 	}
 
-	sc := sonar.NewSonarConfig(o.apiToken, o.workingDir, o.ceTaskURL, o.projectKey, o.serverURL, o.revision)
+	sc := sonar.NewSonarConfig(o.apiToken, o.workingDir, o.ceTaskURL, o.projectKey, o.serverURL, o.revision, o.maxWait)
 
-	o.payload.SonarResults, err = sc.GetSonarResults()
+	o.payload.SonarResults, err = sc.GetSonarResults(logger)
 	if err != nil {
 		return err
 	}

cmd/kosli/root.go

@@ -241,6 +241,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file,
 	sonarProjectKeyFlag                  = "[conditional] The project key of the SonarCloud/SonarQube project. Only required if you want to use the project key/revision to get the scan results rather than using Sonar's metadata file."
 	sonarServerURLFlag                   = "[conditional] The URL of your SonarQube server. Only required if you are using SonarQube and not using SonarQube's metadata file to get scan results."
 	sonarRevisionFlag                    = "[conditional] The revision of the SonarCloud/SonarQube project. Only required if you want to use the project key/revision to get the scan results rather than using Sonar's metadata file and you have overridden the default revision, or you aren't using a CI. Defaults to the value of the git commit flag."
+	sonarMaxWaitFlag                     = "[optional] Allow the command to wait and retry fetching the scan results from SonarQube, up to the maximum number of seconds provided, with exponential backoff. Useful when using SonarQube's metadata file to retrieve and attest scans that take a long time to process . Defaults to 30 seconds."
 	logicalEnvFlag                       = "[required] The logical environment."
 	physicalEnvFlag                      = "[required] The physical environment."
 	attestationTypeDescriptionFlag       = "[optional] The attestation type description."

internal/sonar/sonar.go

@@ -8,6 +8,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
+
+	log "github.com/kosli-dev/cli/internal/logger"
 )
 
 type SonarConfig struct {
@@ -17,6 +20,7 @@ type SonarConfig struct {
 	revision   string
 	projectKey string
 	serverURL  string
+	maxWait    int
 }
 
 // Structs to build the JSON for our attestation payload
@@ -109,18 +113,19 @@ type Error struct {
 	Msg string `json:"msg"`
 }
 
-func NewSonarConfig(apiToken, workingDir, ceTaskUrl, projectKey, serverURL, revision string) *SonarConfig {
+func NewSonarConfig(apiToken, workingDir, ceTaskUrl, projectKey, serverURL, revision string, maxWait int) *SonarConfig {
 	return &SonarConfig{
 		APIToken:   apiToken,
 		WorkingDir: workingDir,
 		CETaskUrl:  ceTaskUrl,
 		revision:   revision,
 		projectKey: projectKey,
 		serverURL:  serverURL,
+		maxWait:    maxWait,
 	}
 }
 
-func (sc *SonarConfig) GetSonarResults() (*SonarResults, error) {
+func (sc *SonarConfig) GetSonarResults(logger *log.Logger) (*SonarResults, error) {
 	httpClient := &http.Client{}
 	var analysisID, tokenHeader string
 	var err error
@@ -159,7 +164,7 @@ func (sc *SonarConfig) GetSonarResults() (*SonarResults, error) {
 
 	if analysisID == "" {
 		//Get the analysis ID, status, project name and branch data from the ceTaskURL (ce API)
-		analysisID, err = GetCETaskData(httpClient, project, sonarResults, sc.CETaskUrl, tokenHeader)
+		analysisID, err = GetCETaskData(httpClient, project, sonarResults, sc.CETaskUrl, tokenHeader, sc.maxWait, logger)
 		if err != nil {
 			return nil, err
 		}
@@ -210,32 +215,69 @@ func (sc *SonarConfig) readFile(project *Project, results *SonarResults) error {
 	return nil
 }
 
-func GetCETaskData(httpClient *http.Client, project *Project, sonarResults *SonarResults, ceTaskURL, tokenHeader string) (string, error) {
+func GetCETaskData(httpClient *http.Client, project *Project, sonarResults *SonarResults, ceTaskURL, tokenHeader string, maxWait int, logger *log.Logger) (string, error) {
 	taskRequest, err := http.NewRequest("GET", ceTaskURL, nil)
 	taskRequest.Header.Add("Authorization", tokenHeader)
 	if err != nil {
 		return "", err
 	}
 
-	taskResponse, err := httpClient.Do(taskRequest)
-	if err != nil {
-		return "", err
+	wait := 1    // start wait period
+	retries := 0 // number of retries so far
+	elapsed := 0 // seconds elapsed
+	taskResponseData := &TaskResponse{}
+
+	for elapsed < maxWait {
+		taskResponse, err := httpClient.Do(taskRequest)
+		if err != nil {
+			return "", err
+		}
+
+		err = json.NewDecoder(taskResponse.Body).Decode(taskResponseData)
+		if err != nil {
+			return "", fmt.Errorf("please check your API token is correct and you have the correct permissions in SonarQube")
+		}
+
+		if taskResponseData.Task.Status == "PENDING" || taskResponseData.Task.Status == "IN_PROGRESS" {
+			// So that we don't wait longer than maxWait
+			if (elapsed + wait) > maxWait {
+				wait = maxWait - elapsed
+			}
+
+			logger.Info("retry %d: waiting %ds for SonarQube scan to be processed...", retries+1, wait)
+			time.Sleep(time.Duration(wait) * time.Second)
+
+			if elapsed > 300 { // If we've waited 5 minutes, we'll wait 300 seconds (5 minutes) before checking again. This is so that we don't end up with extremely long waiting intervals with the doubling approach.
+				elapsed += wait
+				retries++
+				wait += 300
+			} else { // Otherwise, we'll double the wait time each time
+				elapsed += wait
+				retries++
+				wait *= 2
+			}
+		} else {
+			taskResponse.Body.Close()
+			break
+		}
 	}
 
-	taskResponseData := &TaskResponse{}
-	err = json.NewDecoder(taskResponse.Body).Decode(taskResponseData)
-	if err != nil {
-		return "", fmt.Errorf("please check your API token is correct and you have the correct permissions in SonarQube")
+	if elapsed != 0 {
+		logger.Info("Waited for %d seconds for SonarQube scan to be processed. %d retries.\n", elapsed, retries)
 	}
 
-	project.Name = taskResponseData.Task.ComponentName
-	project.Key = taskResponseData.Task.ComponentKey
-	sonarResults.TaskID = taskResponseData.Task.TaskID
-	analysisId := taskResponseData.Task.AnalysisID
-	sonarResults.Status = taskResponseData.Task.Status
+	task := taskResponseData.Task
+
+	project.Name = task.ComponentName
+	project.Key = task.ComponentKey
+	sonarResults.TaskID = task.TaskID
+	analysisId := task.AnalysisID
+	sonarResults.Status = task.Status
 
+	// This should only happen if the task is pending - either because the project is large and the scan takes a long time
+	// to process, or because SonarQube is experiencing delays for some reason.
 	if analysisId == "" {
-		return "", fmt.Errorf("analysis ID not found on %s", sonarResults.ServerUrl) // This should never happen
+		return "", fmt.Errorf("analysis ID not found on %s. The scan results are not yet available, likely due to: \n1. Your project being particularly large and the scan taking time to process, or \n2. SonarQube is experiencing delays in processing scans. \nTry rerunning the command with the --max-retries flag.", sonarResults.ServerUrl)
 	}
 
 	if project.Url == "" {
@@ -250,7 +292,6 @@ func GetCETaskData(httpClient *http.Client, project *Project, sonarResults *Sona
 		sonarResults.Branch = nil
 	}
 
-	taskResponse.Body.Close()
 	return analysisId, nil
 }