We are developing reusable Github actions for our organisation. We want to scan the files (powershell, python, yaml, bicep) with Sonarcloud. The problem is that only the action.yaml files are scanned. All others are skipped. The files (actions) with corresponding yaml, powershell and bicep files are all located under .github-folder.
When a file is moved out of the .github-folder the files are picked up and scanned.
Hey @mortenbgo, welcome to the Community! Indeed, the scanner treats .github as a “hidden” path: files there are analyzed for secrets and GitHub actions in there are also analyzed, but normal language analyzers don’t pick up code in hidden folders. I will let the devs know that you’re running into this issue, perhaps this is something they want to consider.
In the meantime, you could try some workarounds:
Recommended: keep your GitHub Actions workflows in .github/workflows/**, but move the actual scripts you want fully analyzed into a non-hidden directory (for example ci-scripts/ or tools/) and reference them from the workflows.
Trickier: set the sonar.sources=./,.github/scripts and sonar.scanner.excludeHiddenFiles=true scanner params. Note that this restores analysis of that folder but disables secrets analysis for other hidden files. Try at your own risk. Source: another Community thread.
Thank you for your reply. We will definetly try this and let you know how that goes. I appreciate your are letting the developers know.
Hello @mortenbgo,
Thanks again for reaching out.
I’ve filed a ticket in our issue tracker to include the .github folder by default in the analysis.
Best,
Sebastian Zumbrunn
Hello @mortenbgo again,
The ticket has been implemented, merged and released on SonarQube Cloud. As such, the files in the .github folder should be analyzed by all analyzers.
Best,
Sebastian Zumbrunn
That is really good news. I appreciate the quick implementation.