Sonar Cloud Scanner Custom GitHub Action (docker image)

SonarScanner for .NET for use in Github Actions, with automatic pull request detection, analysis and decoration.

Husky.Net

Husky.Net

cd [Solution directory]
dotnet new tool-manifest --force
dotnet tool install Husky
dotnet husky install

Make entrypoint.sh file executable

git update-index --chmod=+x entrypoint.sh

Check permission (it should start with 100755 where 755 are the attributes for an exexutable file)

git ls-files -s entrypoint.sh

Usage examples

Simple use with SonarCloud

env:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: SonarScanner for .NET
      uses: 3dhdsoft/SonarscanEx@latest
      with:
        # The name of the SonarQube organization in SonarCloud. For hosted SonarQube, skip this setting.
        sonarOrganization: organization

        # The name of the SonarQube project
        sonarProjectName:  projectname

        # The key of the SonarQube project
        sonarProjectKey: projectkey

Include code coverage with Coverlet

Also includes test results.

env:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: SonarScanner for .NET
      uses: 3dhdsoft/SonarscanEx@latest
      with:
        # The name of the SonarQube organization in SonarCloud. For hosted SonarQube, skip this setting.
        sonarOrganization: organization

        # The name of the SonarQube project
        sonarProjectName:  projectname

        # The key of the SonarQube project
        sonarProjectKey: projectkey

        # Optional command arguments to dotnet test
        dotnetTestArguments: --logger trx --collect:"XPlat Code Coverage" -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=opencover

        # Optional extra command arguments the the SonarScanner 'begin' command
        sonarBeginArguments: /d:sonar.cs.opencover.reportsPaths="**/TestResults/**/coverage.opencover.xml" -d:sonar.cs.vstest.reportsPaths="**/TestResults/*.trx"

Build subfolder src, and include code coverage

Also includes test results.

env:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: SonarScanner for .NET
      uses: 3dhdsoft/SonarscanEx@latest
      with:
        # The name of the SonarQube organization in SonarCloud. For hosted SonarQube, skip this setting.
        sonarOrganization: organization

        # The name of the SonarQube project
        sonarProjectName:  projectname

        # The key of the SonarQube project
        sonarProjectKey: projectkey

        # Optional command arguments to dotnet build
        dotnetBuildArguments: ./src

        # Optional command arguments to dotnet test
        dotnetTestArguments: ./src --logger trx --collect:"XPlat Code Coverage" -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=opencover

        # Optional extra command arguments the the SonarScanner 'begin' command
        sonarBeginArguments: /d:sonar.cs.opencover.reportsPaths="**/TestResults/**/coverage.opencover.xml" -d:sonar.cs.vstest.reportsPaths="**/TestResults/*.trx"

Skip tests

env:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: SonarScanner for .NET
      uses: 3dhdsoft/SonarscanEx@latest
      with:
        # The name of the SonarQube Organization
        sonarOrganization: organization

        # The name of the SonarQube project
        sonarProjectName:  projectname

        # The key of the SonarQube project
        sonarProjectKey: projectkey

        # Optional. Set to 1 or true to not run 'dotnet test' command
        dotnetDisableTests: true

Use pre-build command to add a custom NuGet repository

env:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: SonarScanner for .NET
      uses: 3dhdsoft/SonarscanEx@latest
      with:
        # The name of the SonarQube organization in SonarCloud. For hosted SonarQube, skip this setting.
        sonarOrganization: organization

        # The name of the SonarQube project
        sonarProjectName:  projectname

        # The key of the SonarQube project
        sonarProjectKey: projectkey

        # Optional command to run before 'dotnet build'. This example adds a NuGet source for other private GitHub Packages registry.
        dotnetPreBuildCmd: dotnet nuget add source --username github_user --password ${{ secrets.MY_PAT_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/OWNER/index.json"

        # Optional command arguments to dotnet build
        dotnetBuildArguments: ./src

Use with self-hosted SonarQube

env:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: SonarScanner for .NET
      uses: 3dhdsoft/SonarscanEx@latest
      with:
        # The name of the SonarQube project
        sonarProjectName:  projectname

        # The key of the SonarQube project
        sonarProjectKey: projectkey

        # The SonarQube server URL. For SonarCloud, skip this setting.
        sonarHostname:  selfhosted_sonarqube_hostname

Secrets

• SONAR_TOKEN – Required this is the token used to authenticate access to SonarCloud. You can generate a token on your Security page in SonarCloud. You can set the SONAR_TOKEN environment variable in the "Secrets" settings page of your repository.
• GITHUB_TOKEN – Provided by Github (see Authenticating with the GITHUB_TOKEN).

Description of all inputs

inputs:
  sonarOrganization:
    description: "The name of the SonarQube organization in SonarCloud. For hosted SonarQube, skip this setting."
    required: false

  sonarProjectName:
    description: "The name of the SonarQube project"
    required: true

  sonarProjectKey:
    description: "The key of the SonarQube project"
    required: true

  sonarHostname:
    description: "The SonarQube server URL. For SonarCloud, skip this setting."
    default: "https://sonarcloud.io"
    required: false

  sonarBeginArguments:
    description: "Optional extra command arguments the the SonarScanner 'begin' command"
    required: false

  dotnetPreBuildCmd:
    description: "Optional command run before the 'dotnet build'"
    required: false

  dotnetBuildArguments:
    description: "Optional command arguments to 'dotnet build'"
    required: false

  dotnetTestArguments:
    description: "Optional command arguments to 'dotnet test'"
    required: false

  dotnetDisableTests:
    description: "Optional. Set to 1 or true to not run 'dotnet test' command"
    required: false

  githubRunNumber:
    description: "Optional. GitHub run number (how many times the caller job has been ran)"
    required: false

Troubleshooting

Build error "ERROR: Could not find a default branch to fall back on."

If this error occurs in the build log, you can try this:

• You may have to manually create the project in SonarQube/SonarCloud dashboard first. Make sure the Action input parameter sonarProjectKey (and sonarOrganization for SonarCloud) matches the ones in SonarQube/SonarCloud.
• Make sure you have correct SONAR_TOKEN set. See Secrets above.

SonarQube/SonarCloud dashboard warning "Shallow clone detected during the analysis..."

If the SonarQube/SonarCloud dashboard shows a warning message in the top right ("Last analysis had x warning"), and the message is

"Shallow clone detected during the analysis. Some files will miss SCM information. This will affect features like auto-assignment of issues. Please configure your build to disable shallow clone."

it can be fixed by modifying the Git checkout action fetch-depth parameter:

- uses: actions/checkout@v2
      with:
        fetch-depth: '0'