Sonar analysis in Github Action Workflow

I am migrating from gitlab to github workflows and having issues to get the sonar analysis running.
Also I am not sure if I should, as before, run the mvn sonar plugin, or the github sonar action instead? In any case, I have defined a specific profile for the tests, where jacoco is configured correctly… so when using the sonar github action command, I guess I would have to somehow migrate the setttings of the profile.

Finally, what about “sonar-project.properties” - is that still used?

Anyway, here is my current github action workflow:

name: Manual Build

on:
workflow_dispatch:

jobs:
maven-build:
runs-on: ubuntu-latest

services:
  mariadb:
    image: mariadb:10.6.4
    env:
      MARIADB_DATABASE: my-app
      MARIADB_ROOT_PASSWORD: secret
      MARIADB_USER: admin
      MARIADB_PASSWORD: admin
      SONAR_HOST_URL: https://sonarcloud.io
    ports:
      - 3306:3306

steps:
  - name: Checkout repository
    uses: actions/checkout@v4

  - name: Set up JDK 22
    uses: actions/setup-java@v4
    with:
      java-version: '22'
      distribution: 'temurin'
      cache: maven

  - name: Cache Maven packages
    uses: actions/cache@v3
    with:
      path: ~/.m2/repository
      key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
      restore-keys: ${{ runner.os }}-maven

  - name: Build and Test with Maven
    run: |
      mvn -q -B clean verify sonar:sonar -Pcoverage \
         -Dsonar.inclusions=**/*.java \
         -Dsonar.organization=secret
         -Dsonar.projectKey=secret
         -Dsonar.sonar.host.url=https://sonarcloud.io
    env:
      QUARKUS_DATASOURCE_JDBC_URL: jdbc:mariadb://localhost:3306/my-app
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@v3

  - name: Log in to GitHub Container Registry
    uses: docker/login-action@v3
    with:
      registry: ghcr.io
      username: ${{ github.actor }}
      password: ${{ secrets.GITHUB_TOKEN }}

  - name: Build and push Docker image
    run: |
      IMAGE_TAG=ghcr.io/${{ github.repository }}/my-app:${{ github.sha }}
      docker build -f src/main/docker/Dockerfile.jvm -t $IMAGE_TAG .
      docker push $IMAGE_TAG

And here is my Maven profile for the sonar plugin:

    <profile>
        <id>coverage</id>
        <dependencies>
            <dependency>
                <groupId>org.jacoco</groupId>
                <artifactId>org.jacoco.agent</artifactId>
                <classifier>runtime</classifier>
                <scope>test</scope>
                <version>${jacoco.version}</version>
            </dependency>
        </dependencies>
        <build>
            <plugins>
                <plugin>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${surefire-plugin.version}</version>
                    <configuration>
                        <excludedGroups>integration</excludedGroups>
                        <systemPropertyVariables>
                            <jacoco-agent.destfile>${project.build.directory}/jacoco-ut.exec</jacoco-agent.destfile>
                            <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                        </systemPropertyVariables>
                        <argLine>--enable-preview</argLine>
                    </configuration>
                    <executions>
                        <execution>
                            <id>integration-tests</id>
                            <phase>integration-test</phase>
                            <goals>
                                <goal>test</goal>
                            </goals>
                            <configuration>
                                <excludedGroups>!integration</excludedGroups>
                                <groups>integration</groups>
                                <systemPropertyVariables>
                                    <jacoco-agent.destfile>${project.build.directory}/jacoco-it.exec
                                    </jacoco-agent.destfile>
                                </systemPropertyVariables>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <artifactId>maven-failsafe-plugin</artifactId>
                    <version>${surefire-plugin.version}</version>
                    <executions>
                        <execution>
                            <goals>
                                <goal>integration-test</goal>
                                <goal>verify</goal>
                            </goals>
                            <configuration>
                                <systemPropertyVariables>
                                    <native.image.path>
                                        ${project.build.directory}/${project.build.finalName}-runner
                                    </native.image.path>
                                    <java.util.logging.manager>org.jboss.logmanager.LogManager
                                    </java.util.logging.manager>
                                </systemPropertyVariables>
                                <argLine>--enable-preview</argLine>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>${jacoco.version}</version>
                    <executions>
                        <execution>
                            <id>instrument-ut</id>
                            <goals>
                                <goal>instrument</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>restore-ut</id>
                            <goals>
                                <goal>restore-instrumented-classes</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>report-ut</id>
                            <goals>
                                <goal>report</goal>
                            </goals>
                            <configuration>
                                <dataFile>${project.build.directory}/jacoco-ut.exec</dataFile>
                                <outputDirectory>${project.reporting.outputDirectory}/jacoco-ut</outputDirectory>
                            </configuration>
                        </execution>
                        <execution>
                            <id>instrument-it</id>
                            <phase>pre-integration-test</phase>
                            <goals>
                                <goal>instrument</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>restore-it</id>
                            <phase>post-integration-test</phase>
                            <goals>
                                <goal>restore-instrumented-classes</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>report-it</id>
                            <phase>post-integration-test</phase>
                            <goals>
                                <goal>report</goal>
                            </goals>
                            <configuration>
                                <dataFile>${project.build.directory}/jacoco-it.exec</dataFile>
                                <outputDirectory>${project.reporting.outputDirectory}/jacoco-it</outputDirectory>
                            </configuration>
                        </execution>
                        <execution>
                            <id>merge-results</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>merge</goal>
                            </goals>
                            <configuration>
                                <fileSets>
                                    <fileSet>
                                        <directory>${project.build.directory}</directory>
                                        <includes>
                                            <include>*.exec</include>
                                        </includes>
                                    </fileSet>
                                </fileSets>
                                <destFile>${project.build.directory}/jacoco.exec</destFile>
                            </configuration>
                        </execution>
                        <execution>
                            <id>post-merge-report</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>report</goal>
                            </goals>
                            <configuration>
                                <dataFile>${project.build.directory}/jacoco.exec</dataFile>
                                <outputDirectory>${project.reporting.outputDirectory}/jacoco</outputDirectory>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </build>
    </profile>


Thanks a lot for your help!

Update - I just realized - in sonarcloud, I am connected with my Gitlab Account… I tried to setup a new account with my Github Account, but then it wants me to pay for a second Sonarcloud account. Should I instead delete / reset my existing Account… but that would mean I would loose all my project history!

I want to keep the projects, I want to keep the history, just the location of the repository should change - is that possible?

Hi,

Unfortunately, it’s currently not possible to unbind an organization and bind it to something else. Explicitly: yes, you’ll need to start over and lose your history. :frowning:

You can vote for adding a rebinding feature here.

The only way to have your organization bound to a different DevOps Platform currently is to create a new organization and re-import your repositories there. Unfortunately, that means you’ll lose the results of previous analyses on these projects.

If you have a yearly subscription for your current organization, a new coupon can be issued for your new organization by reaching out to your sale representative.
If you have a monthly subscription by credit card, you can simply stop your subscription on the old organization and re-subscribe on the new one.

On the plus side, when you (re)create the new organization, you’ll have the opportunity to walk through the in-product tutorial for setting up analysis configuration, and it’ll guide you to the correct configuration.

Sorry for the inconvenience.

 
Ann

Unfortunately, it’s currently not possible to unbind an organization and bind it to something else. Explicitly: yes, you’ll need to start over and lose your history. :frowning:

  1. I can’t believe this can be true. This is a major bummer. And hard to understand because it should be very simple to implement. No idea how to dseal with this.

  2. Also, this does only answer half of my question - how can I setup sonarsource with Github Actions (see above)

  3. Vote… where?

Hi,

After you bind your organization to GitHub, you’ll have to re-import your projects. The wizards will help you with the GHActions setup

 
Ann

I asked how I should call Sonar from my Github job.

Hi,

And the onboarding wizard will give you exactly that.

 
HTH,
Ann