feat: add SonarCloud CI-based analysis#20
Conversation
📝 WalkthroughWalkthroughAdds SonarCloud/SonarQube analysis to CI: a new GitHub Actions job runs tests with coverage and performs a SonarCloud scan; a SonarQube properties file is added to configure project metadata, sources, exclusions, and coverage report paths. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Developer
participant GH_Actions as GitHub Actions Runner
participant Repo as Repository
participant Node as Node.js environment
participant SonarAction as SonarSource Action
participant SonarCloud as SonarCloud
Developer->>Repo: push branch / open PR
Repo->>GH_Actions: trigger CI workflow
GH_Actions->>Repo: checkout (fetch-depth: 0)
GH_Actions->>Node: setup Node.js 20
GH_Actions->>Node: npm ci
GH_Actions->>Node: run tests (with coverage)
Node->>GH_Actions: test results + coverage reports
GH_Actions->>SonarAction: invoke SonarCloud scan (GITHUB_TOKEN, SONAR_TOKEN)
SonarAction->>SonarCloud: upload sources, tests, coverage
SonarCloud-->>SonarAction: analysis results
SonarAction-->>GH_Actions: scan exit/status
GH_Actions-->>Repo: report workflow status (checks)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Warning Tools execution failed with the following error: Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #20 +/- ##
=======================================
Coverage 92.83% 92.83%
=======================================
Files 22 22
Lines 3240 3240
Branches 921 921
=======================================
Hits 3008 3008
Misses 232 232 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/ci.yml (2)
49-56: Consider adding a dependency on the test job.The
sonarcloudjob currently runs independently. If the intention is to only run SonarCloud analysis when tests pass, consider addingneeds: testto ensure test failures block the analysis.🔎 Proposed change to add job dependency
sonarcloud: name: SonarCloud Analysis runs-on: ubuntu-latest + needs: test steps:
58-68: Consider reusing coverage artifacts to reduce CI time.The
test:coveragecommand is executed in both thetestjob (line 37-39) and thesonarcloudjob (line 67-68). While this ensures SonarCloud has fresh coverage data, it duplicates effort and increases CI execution time.💡 Optional approach to share coverage artifacts
If you want to optimize CI time, you could:
- Upload coverage artifacts in the test job:
- name: Upload coverage artifact if: matrix.node-version == 20 uses: actions/upload-artifact@v4 with: name: coverage path: coverage/
- Download artifacts in the sonarcloud job:
sonarcloud: name: SonarCloud Analysis runs-on: ubuntu-latest needs: test steps: - name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 0 - name: Download coverage artifact uses: actions/download-artifact@v4 with: name: coverage path: coverage/ - name: SonarCloud Scan uses: SonarSource/sonarcloud-github-action@master env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}This eliminates the need to install dependencies and run tests again in the sonarcloud job.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/ci.ymlsonar-project.properties
🔇 Additional comments (4)
sonar-project.properties (4)
1-2: LGTM!The project key and organization are properly configured for SonarCloud.
8-13: Source and test directories are correctly configured.The
srcandtestsdirectories exist and contain the expected project files. The sonar-project.properties configuration is valid.
15-23: Verify the coverage report path.Ensure that the test coverage command (
npm run test:coverage) generates the LCOV report atcoverage/lcov.infoas specified in the sonar-project.properties configuration. Check the test configuration (jest.config.js, vitest.config.ts, etc.) to confirm the coverageDirectory setting matches.
4-6: No issues found. The project version0.3.0in sonar-project.properties already aligns with package.json.
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
49-56: Job setup looks good, but consider adding job dependency.The checkout configuration with
fetch-depth: 0is correct for comprehensive SonarCloud analysis. However, thesonarcloudjob runs independently and in parallel with thetestjob. Consider addingneeds: testto ensure tests pass before running the analysis, or keep the current parallel execution if faster feedback is preferred.Optional: Add job dependency to ensure tests pass first
sonarcloud: name: SonarCloud Analysis runs-on: ubuntu-latest + needs: test steps:
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/ci.ymlsonar-project.properties
🔇 Additional comments (7)
.github/workflows/ci.yml (2)
58-68: Setup and coverage generation are correct.The Node.js setup and dependency installation follow standard patterns. Running tests with coverage in this job is necessary since the
sonarcloudjob executes independently. The coverage duplication with thetestjob (line 37-39) is acceptable for parallel execution.
70-74: [Rewritten comment]
[Classification tag]sonar-project.properties (5)
1-3: Verify project key and organization match SonarCloud setup.Ensure that
sonar.projectKey=abdullahmujahidali_Cellifyandsonar.organization=abdullahmujahidaliexactly match the configuration in your SonarCloud account, as mismatches will cause the scan to fail.
13-17: Exclusions and test inclusions are correctly configured.The exclusion patterns appropriately filter out build artifacts (
dist), dependencies (node_modules), coverage reports, and WASM build output. Test file patterns (**/*.test.ts,**/*.spec.ts) are correctly identified for test coverage analysis.
5-7: Ensure project version in sonar-project.properties matches package.json.The
sonar.projectVersion=0.3.0should align with the version specified inpackage.jsonto maintain consistency across the project.
19-24: Verify coverage report path matches test output.The LCOV report paths point to
coverage/lcov.info. Ensure your test configuration (likely injest.config.jsor similar) generates the coverage report at this exact path.
9-11: Verify test directory path is correct.Ensure the
sonar.tests=testsdirectory exists. Some projects usetest(singular) or co-locate tests with source files. Verify this matches your actual project structure.
1 participant
Description
Brief description of changes.
Type of Change
Related Issues
Fixes #(issue number)
Checklist
npm test)Testing
Describe how you tested these changes.
Screenshots (if applicable)
Add screenshots to help explain your changes.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.