chore(deps): bump docker/login-action from 4.4.0 to 4.6.0 #121
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SonarCloud | |
| # CI-based SonarCloud analysis (required to ingest LCOV coverage; automatic | |
| # analysis must be DISABLED in the SonarCloud project settings). Inert until a | |
| # SONAR_TOKEN repository secret is configured - see docs/TOOLCHAIN.md and | |
| # sonar-project.properties for activation steps. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least-privilege: analysis only reads the repo; the Sonar token is a separate secret. | |
| permissions: | |
| contents: read | |
| jobs: | |
| sonarcloud: | |
| name: analysis | |
| # Skip on PRs from forks AND on Dependabot PRs: GitHub exposes secrets | |
| # (SONAR_TOKEN) to neither fork-triggered nor Dependabot-triggered runs, so | |
| # the scan would fail through no fault of the PR — and analyzing a | |
| # dependency bump adds nothing. Sonar still runs on push to main and on | |
| # same-repo human PRs; everything else is analyzed after it merges to main. | |
| if: ${{ (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 # full history for accurate new-code / blame attribution | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version-file: .bun-version | |
| - run: bun install --frozen-lockfile | |
| # lcov reporter is configured in bunfig.toml -> coverage/lcov.info | |
| - run: bun test --coverage | |
| # Report the package version so SonarCloud's "previous version" new-code | |
| # definition resets the baseline at each release. Single source: package.json | |
| # (node is preinstalled on the runner). Read into a step output, then passed | |
| # to the scanner via args (not interpolated into a shell command). | |
| - id: pkg | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| - uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | |
| with: | |
| args: -Dsonar.projectVersion=${{ steps.pkg.outputs.version }} | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| SONAR_HOST_URL: https://sonarcloud.io | |
| # Run summary on the run page (no emoji, per repo convention). The full | |
| # results live on SonarCloud; this links straight to the dashboard. | |
| - name: Job summary | |
| if: always() | |
| run: | | |
| { | |
| echo "## SonarCloud analysis" | |
| echo "" | |
| echo "- Project version analyzed: \`${{ steps.pkg.outputs.version }}\`" | |
| echo "- New code is measured since the previous version." | |
| echo "- [Open the SonarCloud dashboard](https://sonarcloud.io/summary/overall?id=libredb_libredb-database)" | |
| } >> "$GITHUB_STEP_SUMMARY" |