ENH: add sonar configuration

[fedorov]

done following the steps in

https://sonarcloud.io/project/configuration/GitHubActions?id=ImagingDataCommons_dicom-microscopy-viewer

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fedorov]

@igoroctaviano @pedrokohler I can't figure out why SONAR_TOKEN is empty inside the action workflow... Any ideas?

[pedrokohler]

@igoroctaviano @pedrokohler I can't figure out why SONAR_TOKEN is empty inside the action workflow... Any ideas?

I don't have access to this link https://sonarcloud.io/project/configuration/GitHubActions?id=ImagingDataCommons_dicom-microscopy-viewer... it redirects to https://sonarcloud.io/summary/new_code?id=ImagingDataCommons_dicom-microscopy-viewer so I can't tell what are the instructions there to be able to help you effectively.

However I'm curious... what happens if you remove this?

[igoroctaviano]

@igoroctaviano @pedrokohler I can't figure out why SONAR_TOKEN is empty inside the action workflow... Any ideas?

@igoroctaviano @pedrokohler I can't figure out why SONAR_TOKEN is empty inside the action workflow... Any ideas?

Try:

  - name: Check SONAR_TOKEN
    run: echo "SONAR_TOKEN length is $(echo -n $SONAR_TOKEN | wc -c)"
    env:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} 

[fedorov]

@igoroctaviano no difference. It's as if the action does not have access to the secret.

[fedorov]

However I'm curious... what happens if you remove this?

@pedrokohler that is just a printout to test whether that secret is accessible at all. If it prints out 0, it means there is no access. Removing it will just remove the ability to debug.

[igoroctaviano]

@fedorov a different env declaration is:

name: Build
permissions:
  contents: read
  pull-requests: read

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

on:
  push:
    branches:
      - master
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  sonarcloud:
    name: SonarQube Cloud
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
          
      - name: Check SONAR_TOKEN
        run: echo "SONAR_TOKEN length is $(echo -n $SONAR_TOKEN | wc -c)"
        
      - name: Install dependencies
        run: yarn
        
      - name: Test and coverage
        run: yarn jest --coverage
        
      - name: SonarQube Cloud Scan
        uses: SonarSource/sonarcloud-github-action@master