ci: configure Stylelint and SonarQube report paths for multiple linters#156
Conversation
- Configure Stylelint in `clients/web` with Vue and Tailwind support. - Add `lint:style` script to `clients/web/package.json`. - Update `sonarqube-analysis.yml` to run Stylelint, Hadolint, and Actionlint. - Enable Android Lint generation in Gradle step. - Configure SonarQube report paths for Stylelint, Android Lint, Hadolint, and Actionlint. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds pnpm setup and caching to the SonarQube CI workflow, runs stylelint/hadolint/actionlint (reporting outputs), includes lintDebug in Gradle test step, and adds a Stylelint config, script, and devDependencies to the web client. (29 words) Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Dev (push)
participant GH as GitHub Actions Runner
participant Node as Node / pnpm
participant Linters as Linters (stylelint, hadolint, actionlint)
participant Sonar as SonarQube Scanner
Dev->>GH: push / PR triggers workflow
GH->>Node: setup Node + pnpm (with cache) (rgba(30,144,255,0.5))
GH->>Node: pnpm install (root + clients/web) (rgba(30,144,255,0.5))
GH->>Linters: run stylelint, hadolint, actionlint (produce reports) (rgba(34,139,34,0.5))
GH->>Sonar: run tests/build (includes lintDebug) (rgba(255,165,0,0.5))
GH->>Sonar: upload scanner reports (coverage, stylelint, hadolint, actionlint) (rgba(255,165,0,0.5))
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Deploying corvus with
|
| Latest commit: |
4f106de
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b3f1b9b3.corvus-42x.pages.dev |
| Branch Preview URL: | https://ci-configure-sonar-linters-r.corvus-42x.pages.dev |
✅ Contributor ReportUser: @yacosta738
Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-03-07 to 2026-03-07 |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sonarqube-analysis.yml:
- Around line 106-108: The hadolint Docker run command uses unquoted command
substitution for $(find . -name "Dockerfile*" -not -path "*/node_modules/*"),
which breaks on paths with spaces; change it to use a null-delimited find +
xargs pipeline so filenames with spaces are handled safely (e.g. replace the
substitution with find . -name "Dockerfile*" -not -path "*/node_modules/*"
-print0 | xargs -0 hadolint -f json), and invoke that inside the docker run
(adjust the docker run invocation around the hadolint call) so the hadolint
command (the docker run line that calls hadolint) receives correctly quoted
filenames.
- Around line 110-114: Replace the unpinned download-and-execute step that uses
"bash <(curl
https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)"
with a pinned approach: either reference a specific release of the script or,
preferably, switch the "🤖 Run Actionlint" step to use the maintained GitHub
Action "rhysd/actionlint@v1.7.11" and pass the format input (format: '{{json
.}}') so the run produces the same coverage/actionlint-report.json output
without pulling from main.
In `@clients/web/.stylelintrc.json`:
- Around line 8-21: Add the Tailwind v3+ `@layer` directive to the at-rule ignore
list: update the "at-rule-no-unknown" rule's "ignoreAtRules" array (the existing
array containing
"tailwind","apply","variants","responsive","screen","import","theme") to include
"@layer" so Stylelint won't flag Tailwind `@layer` directives (e.g., `@layer` base,
`@layer` components, `@layer` utilities).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: fb03a0d9-6dd2-428f-a197-b13da74e2e7d
⛔ Files ignored due to path filters (1)
clients/web/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
.github/workflows/sonarqube-analysis.ymlclients/web/.stylelintrc.jsonclients/web/package.json
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cloudflare Pages
🧰 Additional context used
📓 Path-based instructions (1)
**/*
⚙️ CodeRabbit configuration file
**/*: Security first, performance second.
Validate input boundaries, auth/authz implications, and secret management.
Look for behavioral regressions, missing tests, and contract breaks across modules.
Files:
clients/web/package.json
🧠 Learnings (2)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/sonarqube-analysis.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why
Applied to files:
.github/workflows/sonarqube-analysis.yml
🔇 Additional comments (7)
clients/web/package.json (2)
26-27: LGTM!The
lint:stylescript is well-configured with appropriate glob patterns and correctly references the root.gitignorevia relative path.
31-36: LGTM!Stylelint dependencies are appropriately added with caret versioning. The combination of
stylelint-config-standard,stylelint-config-standard-vue, andstylelint-config-recess-orderprovides solid coverage for Vue/Tailwind projects.clients/web/.stylelintrc.json (1)
22-30: LGTM - Rule relaxations are appropriate for Tailwind/Vue.Disabling
no-descending-specificity,selector-class-pattern, and notation rules is standard practice for Tailwind projects where utility classes and dynamic styles are common..github/workflows/sonarqube-analysis.yml (4)
52-67: LGTM!Proper pnpm setup with version pinning and Node cache configuration. The
pnpm installat repo root will correctly install workspace dependencies.
79-81: LGTM!Adding
lintDebugto generate Android Lint output for SonarQube integration is appropriate.
176-179: LGTM!SonarQube report paths are correctly configured for all linters. The glob pattern for Android Lint (
**/build/reports/lint-results-*.xml) handles multiple modules.
102-104: Path is correct. Thecoverage/directory is created at line 95 withmkdir -p coverage, so the relative path../../coverage/fromclients/webcorrectly resolves to the repo-rootcoverage/directory.
- Configure Stylelint in `clients/web` with Vue and Tailwind support (ignoring @layer). - Add `lint:style` script to `clients/web/package.json`. - Update `sonarqube-analysis.yml` to run Stylelint, Hadolint (safe path handling), and Actionlint (pinned v1.7.11). - Enable Android Lint generation in Gradle step. - Configure SonarQube report paths for Stylelint, Android Lint, Hadolint, and Actionlint. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/sonarqube-analysis.yml (1)
65-67:⚠️ Potential issue | 🔴 CriticalStylelint step will fail silently; dependencies not installed for clients/web.
The root
pnpm install(line 67) doesn't installclients/webdependencies because there's no workspaces configuration and nopnpm-workspace.yaml. When the Stylelint step runspnpm -C clients/web run lint:style(line 104), it will fail to find the stylelint binary sinceclients/web/node_moduleswon't exist. The|| truemasks this failure, so the workflow appears successful but the stylelint report won't be generated.Fix: Either add workspaces to root
package.json, or install dependencies in the client directory:- name: 📦 Install dependencies if: env.SONAR_TOKEN != '' - run: pnpm install + run: | + pnpm install + pnpm -C clients/web install🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/sonarqube-analysis.yml around lines 65 - 67, The CI installs dependencies at the root with the existing "pnpm install" step but clients/web dependencies aren't installed, so the later "pnpm -C clients/web run lint:style" (which is masked by "|| true") will silently fail; fix by ensuring clients/web deps are installed before linting—either add workspace configuration to the root package.json/pnpm-workspace.yaml so root "pnpm install" installs workspaces, or add an explicit "pnpm -C clients/web install" step prior to the Stylelint step and remove the "|| true" so failures surface.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/sonarqube-analysis.yml:
- Around line 65-67: The CI installs dependencies at the root with the existing
"pnpm install" step but clients/web dependencies aren't installed, so the later
"pnpm -C clients/web run lint:style" (which is masked by "|| true") will
silently fail; fix by ensuring clients/web deps are installed before
linting—either add workspace configuration to the root
package.json/pnpm-workspace.yaml so root "pnpm install" installs workspaces, or
add an explicit "pnpm -C clients/web install" step prior to the Stylelint step
and remove the "|| true" so failures surface.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b13b6451-e777-4a77-846e-7c4c699f7493
📒 Files selected for processing (2)
.github/workflows/sonarqube-analysis.ymlclients/web/.stylelintrc.json
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: pr-checks
- GitHub Check: pr-checks
- GitHub Check: Cloudflare Pages
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/sonarqube-analysis.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why
Applied to files:
.github/workflows/sonarqube-analysis.yml
🔇 Additional comments (6)
clients/web/.stylelintrc.json (1)
1-33: LGTM!Config properly extends standard, Vue, and recess-order presets. Tailwind at-rules (including
layer) are correctly whitelisted. The disabled rules are appropriate for a Tailwind + Vue project where utility classes and generated specificity patterns are common..github/workflows/sonarqube-analysis.yml (5)
79-81: LGTM!Adding
lintDebuggenerates the Android Lint XML reports consumed by the newsonar.androidLint.reportPathsconfiguration.
102-104: Output path is correct; blocked by missing dependencies.The relative paths (
../../coverage/) resolve correctly fromclients/web. However, this step will fail until the dependency installation issue (lines 65-67) is resolved.
106-109: LGTM!Using
find -exec {} +safely handles paths with spaces. The|| trueallows the workflow to continue even if Dockerfiles have lint issues.
111-114: LGTM!Using the pinned Docker image
rhysd/actionlint:v1.7.11addresses the supply-chain risk from the previous unpinned download script approach.
176-179: LGTM!Report paths correctly reference the outputs from Stylelint, Android Lint, Hadolint, and Actionlint steps.
|
@jules Verify each finding against the current code and only fix it if needed. Duplicate comments:
|
I've addressed the findings from your feedback:
|
- Add explicit `pnpm -C clients/web install` step. - Remove `|| true` from linting steps to surface failures. - Refactor Hadolint and Actionlint to use safe Docker-based execution with `find -exec`. - Add `layer` to Stylelint `at-rule-no-unknown` ignore list. - Ensure all Sonar property keys match requested values. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sonarqube-analysis.yml:
- Around line 110-113: The CI step "🐳 Run Hadolint" currently redirects output
from the find+docker command to coverage/hadolint-report.json which creates an
empty file if no Dockerfiles are found; change the step's run script so it first
checks if find returns any Dockerfiles and only runs hadolint when there are
matches, otherwise write a safe empty JSON (e.g. "[]") or skip creating the
file. Modify the existing command that uses find ... hadolint ... >
coverage/hadolint-report.json to a small shell conditional that tests the find
result (or captures the hadolint output and writes "[]" when empty) so SonarQube
always gets valid JSON or no file.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 498cd823-b63e-4e25-86d5-6fb14d7e9cb0
📒 Files selected for processing (2)
.github/workflows/sonarqube-analysis.ymlclients/web/.stylelintrc.json
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: pr-checks
- GitHub Check: pr-checks
- GitHub Check: Cloudflare Pages
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/sonarqube-analysis.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why
Applied to files:
.github/workflows/sonarqube-analysis.yml
🔇 Additional comments (6)
clients/web/.stylelintrc.json (1)
1-48: LGTM! Well-configured Stylelint setup for Tailwind/Vue.The config appropriately extends standard presets and correctly ignores Tailwind-specific at-rules in both standard and SCSS contexts. The disabled rules are reasonable for utility-first CSS frameworks.
.github/workflows/sonarqube-analysis.yml (5)
52-71: LGTM! Proper pnpm setup with explicit workspace install.Correctly addresses the flagged issue where
clients/webdependencies weren't installed. The pinned action SHA and explicit-C clients/web installstep ensure the Stylelint dependencies are available.
83-85: LGTM! Added Android lint generation.The
lintDebugtask will generate lint reports consumed by SonarQube via theandroidLint.reportPathsproperty.
115-118: LGTM! Actionlint properly pinned to v1.7.11.Addresses the prior security concern about unpinned downloads. The Docker-based execution with explicit version tag is reproducible and secure.
180-183: LGTM! Report paths align with lint outputs.The SonarQube property paths correctly reference the JSON reports generated by the respective lint steps.
106-108: Stylelint violations will block the pipeline before SonarQube analysis runs.The codebase currently has multiple style violations (color formats, property ordering, empty line rules) that will cause this step to fail. Either fix the violations in the source code or append
|| trueto allow the build to continue.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Yuniel Acosta Pérez <33158051+yacosta738@users.noreply.github.com>
- Update `pnpm/action-setup` SHA to working version `41ff72655975bd51cab0327fa583b6e92b6d3061`. - Address PR feedback by adding explicit `pnpm -C clients/web install`. - Surface failures by removing `|| true` from linting steps. - Use safe Docker-based execution for Hadolint and Actionlint with `find -exec`. - Add `layer` to Stylelint ignore list for Tailwind support. - Ensure all Sonar property keys match requested values. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
- Synchronize root `pnpm-lock.yaml` with `package.json`. - Update `pnpm/action-setup` to a verified commit SHA. - Explicitly install `clients/web` dependencies in CI. - Ensure Stylelint configuration ignores Tailwind's `@layer`. - Configure SonarQube report paths for Stylelint, Android Lint, Hadolint, and Actionlint. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
- Configure Stylelint in `clients/web` with Vue/Tailwind support. - Enforce long hex notation and normalize colors across the web module. - Fix CI workflow: use working pnpm action SHA, safe Docker exec for linters. - Sync `pnpm-lock.yaml` with root `package.json`. - Configure SonarQube report paths for Stylelint, Android Lint, Hadolint, and Actionlint. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
- Switch Hadolint and Actionlint to binary-based execution to avoid Docker Hub rate limits. - Ensure 6-digit hex notation consistency across the web monorepo. - Fix pnpm/action-setup SHA to verified version. - Explicitly install clients/web dependencies in CI. - Configure all requested SonarQube report paths. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
- Configure Stylelint in `clients/web` with Vue, SCSS, and Tailwind support. - Enforce 6-digit hex notation across the web module and normalize existing colors. - Fix SonarQube analysis workflow: - Synchronize lockfile and use verified `pnpm/action-setup` SHA. - Explicitly install workspace dependencies. - Use binary-based execution for Hadolint and Actionlint to bypass Docker rate limits. - Correct Sonar report path property keys. - Fix Dockerfiles in `clients/agent-runtime` to resolve Hadolint parse errors. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
yacosta738
deleted the
ci/configure-sonar-linters-reporting-10917054857490866092
branch
1 participant
This PR configures Stylelint in the
clients/webmodule and adds SonarQube report paths for Stylelint, Android Lint, Hadolint, and Actionlint to the CI workflow.Key changes:
clients/web/.stylelintrc.jsonwith standard, vue, and recess-order plugins.clients/web/package.jsonwithlint:stylescript..github/workflows/sonarqube-analysis.ymlto:lintDebugin the Gradle step for Android Lint.sonar.*.reportPathsproperties.PR created automatically by Jules for task 10917054857490866092 started by @yacosta738