Update sonar analysis workflow to new YAML file - #1101
Conversation
Signed-off-by: Chetan Kumar Hirematha <chetankumar.h.239@gmail.com>
WalkthroughThe ChangesCI workflow configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/push-trigger.yml:
- Line 75: Update the reusable workflow reference in push-trigger.yml to pin
maven-sonar-analysis-new.yml to a specific immutable commit SHA instead of the
mutable develop branch. Use the approved commit corresponding to the intended
workflow revision and leave the forwarded secret configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: cfebc495-7cef-4fcf-a50a-13345ac91c9e
📒 Files selected for processing (1)
.github/workflows/push-trigger.yml
| needs: build-maven-mosip-compliance-toolkit | ||
| if: "${{ github.event_name != 'pull_request' }}" | ||
| uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@master | ||
| uses: mosip/kattu/.github/workflows/maven-sonar-analysis-new.yml@develop |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow occurrences =="
fd -a 'push-trigger\.yml|push-trigger\.yaml' .github/workflows 2>/dev/null || true
echo "== relevant reference =="
if [ -f .github/workflows/push-trigger.yml ]; then
nl -ba .github/workflows/push-trigger.yml | sed -n '60,90p'
echo "== secret references in workflow =="
rg -n '\$\{\{\s*secrets\.' .github/workflows/push-trigger.yml || true
fi
echo "== remote refs/tags for target repo/tag-ish? =="
if command -v git >/dev/null 2>&1; then
tmp="$(mktemp -d)"
cd "$tmp"
git init -q
git remote add origin https://github.com/mosip/kattu.git
git fetch --depth=1 origin develop 2>/dev/null || true
git ls-remote origin develop | sed -n '1,5p' || true
git ls-remote --tags origin mosip-kattu-sonar|maven-sonar-analysis-* 2>/dev/null | sed -n '1,20p' || true
fiRepository: mosip/mosip-compliance-toolkit
Length of output: 314
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files .github/workflows/push-trigger.yml || true
echo "== relevant reference =="
if [ -f .github/workflows/push-trigger.yml ]; then
awk 'NR>=60 && NR<=90 {printf "%d\t%s\n", NR, $0}' .github/workflows/push-trigger.yml
echo "== secret references in workflow =="
grep -n '\${{\s*secrets\.' .github/workflows/push-trigger.yml || true
fi
echo "== remote refs for target reusable workflow branch/tag candidates =="
tmp="$(mktemp -d)"
cd "$tmp"
git init -q >/dev/null 2>&1
git remote add origin https://github.com/mosip/kattu.git >/dev/null 2>&1 || true
git fetch --depth=1 origin develop >/dev/null 2>&1 || true
echo "develop:"
git ls-remote origin develop || true
git ls-remote --tags origin | grep -E '(^|[:/])mozip/kattu|(?i)sonar|maven-sonar' | sed -n '1,20p' || true
git ls-remote --tags origin maven-sonar-analysis-new.yml* develop* 2>/dev/null | sed -n '1,20p' || trueRepository: mosip/mosip-compliance-toolkit
Length of output: 2793
Pin the reusable workflow to an immutable commit SHA.
.github/workflows/push-trigger.yml:75 references mosip/kattu/.github/workflows/maven-sonar-analysis-new.yml@develop, while this reusable job forwards sensitive credentials including SONAR_TOKEN, GPG_SECRET, and SLACK_WEBHOOK_URL. Because develop is mutable, later mosip/kattu changes could execute with MOSIP repository secrets without a review of this repository, impacting GDPR/MOSIP security and supply-chain integrity.
🔒 Proposed fix
- uses: mosip/kattu/.github/workflows/maven-sonar-analysis-new.yml@develop
+ uses: mosip/kattu/.github/workflows/maven-sonar-analysis-new.yml@af9db722acf8f74269375d71136efc2c240efa43📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: mosip/kattu/.github/workflows/maven-sonar-analysis-new.yml@develop | |
| uses: mosip/kattu/.github/workflows/maven-sonar-analysis-new.yml@af9db722acf8f74269375d71136efc2c240efa43 |
🧰 Tools
🪛 zizmor (1.28.0)
[error] 75-75: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/push-trigger.yml at line 75, Update the reusable workflow
reference in push-trigger.yml to pin maven-sonar-analysis-new.yml to a specific
immutable commit SHA instead of the mutable develop branch. Use the approved
commit corresponding to the intended workflow revision and leave the forwarded
secret configuration unchanged.
Source: Linters/SAST tools
1 participant
Summary by CodeRabbit