ci: Remove Fossa add Sonarcloud #26
Conversation
| npm test test/unit | ||
| npm test -- --coverage test/unit | ||
| - name: "Security Scan" |
There was a problem hiding this comment.
Do we want to make this a part of build? Do we have any other cases where we want to do security scan without build?
Maybe we should make it depend on build in case it's required for scan?
There was a problem hiding this comment.
SonarCloud unit test coverage requires build in order to be calculated so it would always require build. Now, the opposite question is also valid, does build require sonarcloud to run all the time? Looking through the other GH workflows in the repo, build is not reused. Release workflow actually does a build step, which is different from this one. I'd argue this workflow should be named "PR checks", similar to what we have in Python SDK, and left as is.
There was a problem hiding this comment.
Especially since it does type checking, test running and now SC the name fits better.
|
Kudos, SonarCloud Quality Gate passed!
|
Fossa is no longer supported in Firebolt. We're now relying on dependabot for dependency scanning and sonarcloud for code smells.