v2.0.0

v2 is a rewrite that changes how pull requests from forks are analysed.

• The token stays away from the fork's code. v1 ran Maven or Gradle on the pull request's code in the job that holds the Sonar token. In v2, the build runs without the token. The Sonar workflow then analyses the result and never runs the pull request's code.
• Your own pushes and pull requests are analysed directly in the build, with the token. The Sonar workflow only handles pull requests from forks and Dependabot.
• Beyond Maven and Gradle: v2 also runs Sonar's npm scanner for Node. Anything else works with a sonar-project.properties.
• A new home: the action moved to galois-groups/sonar-fork-analysis.

Coming from v1? v1 gets no more fixes, not even security fixes. Follow migrating from v1. If v1 has analysed pull requests from forks, also rotate your Sonar token and delete your repository's Actions caches. Security explains why.

All changes since v1.3.0

What's Changed

• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3
• Bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #2
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #4
• Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #5
• Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #6
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #7
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #8
• Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #9
• Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #10
• TypeScript action with direct mode by @EvaristeGalois11 in #16
• Drop local-action and keep TypeScript below 7 by @EvaristeGalois11 in #18
• Make the TypeScript config ready for version 6 by @EvaristeGalois11 in #20
• Bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #19
• Add the fork path (prepare and analyze modes) by @EvaristeGalois11 in #21
• Compare the direct and fork path analyses in CI by @EvaristeGalois11 in #22
• Lint and audit the workflows by @EvaristeGalois11 in #23
• Reference the action with the self-repository syntax by @EvaristeGalois11 in #24
• Validate the workflows against GitHub's own schema by @EvaristeGalois11 in #25
• Address the review of the CI hardening by @EvaristeGalois11 in #26
• Keep placeholders away from the Sonar scanner by @EvaristeGalois11 in #28
• Report the fork path's analysis on the pull request by @EvaristeGalois11 in #27
• Carry aggregate coverage reports to the fork path by @EvaristeGalois11 in #31
• Keep Sonar's dependency analysis off on the fork path by @EvaristeGalois11 in #32
• Carry every report and per-language setting, and warn about the rest by @EvaristeGalois11 in #33
• Add a security policy and OpenSSF Scorecard by @EvaristeGalois11 in #30
• Grant write permissions to jobs, not whole workflows by @EvaristeGalois11 in #34
• Check the security properties against generated inputs by @EvaristeGalois11 in #35
• Check settings the way the scanner reads them, and keep it from running the checkout by @EvaristeGalois11 in #36
• Warn when only the build sets the organization by @EvaristeGalois11 in #39
• Pin the Maven fixture's Sonar plugin by @EvaristeGalois11 in #40
• Cancel superseded Fixtures runs on pull requests by @EvaristeGalois11 in #41
• Document v2 by @EvaristeGalois11 in #38
• Describe what the action does in its metadata by @EvaristeGalois11 in #42
• Ship the bundled packages' licences with dist by @EvaristeGalois11 in #43
• Cache the engines between Scanner runs by @EvaristeGalois11 in #44
• Report a newer scanner CLI weekly by @EvaristeGalois11 in #45
• Say that the scanner CLI is pinned by @EvaristeGalois11 in #46
• Analyse any project with Sonar's scanner by @EvaristeGalois11 in #47
• Add npm and pnpm monorepo fixtures, and recreate node_modules links by @EvaristeGalois11 in #48
• Keep the Node fixtures' types on their Node major by @EvaristeGalois11 in #51
• Don't run dependencies' install scripts by @EvaristeGalois11 in #53
• Analyse this repository with its own action by @EvaristeGalois11 in #52
• Address Sonar's findings on this repository by @EvaristeGalois11 in #54
• Split the analysis's longest functions by @EvaristeGalois11 in #55
• Settle Sonar's remaining findings in the code by @EvaristeGalois11 in #56
• Mark the waits between retries too by @EvaristeGalois11 in #57
• Lint with the compiler's types and check the artifact's shape by @EvaristeGalois11 in #58
• Keep the runner's event out of the tests by @EvaristeGalois11 in #59
• Fuzz the analysis's trust boundary by @EvaristeGalois11 in #60
• Check for unused code and dependencies, and the lockfile's sources by @EvaristeGalois11 in #61
• Keep the badges users look for in the header by @EvaristeGalois11 in #62
• Check that the wrappers run on Windows by @EvaristeGalois11 in #63
• Test on macOS and Windows by @EvaristeGalois11 in #64
• Say that the build's artifact expires after a day by @EvaristeGalois11 in #65
• List the supported projects and runners, and what is tested by @EvaristeGalois11 in #66
• Refuse file names that aren't valid UTF-8 by @EvaristeGalois11 in #67
• Resolve paths as the system does by @EvaristeGalois11 in #68
• Keep the token from builds that shouldn't have it by @EvaristeGalois11 in #69
• Map .js imports to .ts with ts-jest's own setting by @EvaristeGalois11 in #70
• Refuse a module base inside .git, and check the CLI's placeholders by @EvaristeGalois11 in #71
• Keep the scanner's zip, checked on every use, and unpack it per job by @EvaristeGalois11 in #72
• Check dist without ignoring whitespace at line ends by @EvaristeGalois11 in #73
• Bring the docs in line with the code by @EvaristeGalois11 in #75
• Move to the galois-groups organization by @EvaristeGalois11 in #78
• Trap what the fixture wrappers need instead of the wrappers by @EvaristeGalois11 in #79
• Bump org.apache.maven:apache-maven from 3.9.16 to 3.10.0 in /fixtures/maven in the maven group across 1 directory by @depen...

v1.3.0

Release v1.3.0

v1.2.0

Full Changelog: v1.0.0...v1.2.0

First release

First release