v2.0.0

v2 is a rewrite that changes how pull requests from forks are analysed.

• The token stays away from the fork's code. v1 ran Maven or Gradle on the pull request's code in the job that holds the Sonar token. In v2, the build runs without the token. The Sonar workflow then analyses the result and never runs the pull request's code.
• Your own pushes and pull requests are analysed directly in the build, with the token. The Sonar workflow only handles pull requests from forks and Dependabot.
• Beyond Maven and Gradle: v2 also runs Sonar's npm scanner for Node. Anything else works with a sonar-project.properties.
• A new home: the action moved to galois-groups/sonar-fork-analysis.

Coming from v1? v1 gets no more fixes, not even security fixes. Follow migrating from v1. If v1 has analysed pull requests from forks, also rotate your Sonar token and delete your repository's Actions caches. Security explains why.

All changes since v1.3.0

What's Changed

• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3
• Bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #2
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #4
• Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #5
• Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #6
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #7
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #8
• Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #9
• Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #10
• TypeScript action with direct mode by @EvaristeGalois11 in #16
• Drop local-action and keep TypeScript below 7 by @EvaristeGalois11 in #18
• Make the TypeScript config ready for version 6 by @EvaristeGalois11 in #20
• Bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #19
• Add the fork path (prepare and analyze modes) by @EvaristeGalois11 in #21
• Compare the direct and fork path analyses in CI by @EvaristeGalois11 in #22
• Lint and audit the workflows by @EvaristeGalois11 in #23
• Reference the action with the self-repository syntax by @EvaristeGalois11 in #24
• Validate the workflows against GitHub's own schema by @EvaristeGalois11 in #25
• Address the review of the CI hardening by @EvaristeGalois11 in #26
• Keep placeholders away from the Sonar scanner by @EvaristeGalois11 in #28
• Report the fork path's analysis on the pull request by @EvaristeGalois11 in #27
• Carry aggregate coverage reports to the fork path by @EvaristeGalois11 in #31
• Keep Sonar's dependency analysis off on the fork path by @EvaristeGalois11 in #32
• Carry every report and per-language setting, and warn about the rest by @EvaristeGalois11 in #33
• Add a security policy and OpenSSF Scorecard by @EvaristeGalois11 in #30
• Grant write permissions to jobs, not whole workflows by @EvaristeGalois11 in #34
• Check the security properties against generated inputs by @EvaristeGalois11 in #35
• Check settings the way the scanner reads them, and keep it from running the checkout by @EvaristeGalois11 in #36
• Warn when only the build sets the organization by @EvaristeGalois11 in #39
• Pin the Maven fixture's Sonar plugin by @EvaristeGalois11 in #40
• Cancel superseded Fixtures runs on pull requests by @EvaristeGalois11 in #41
• Document v2 by @EvaristeGalois11 in #38
• Describe what the action does in its metadata by @EvaristeGalois11 in #42
• Ship the bundled packages' licences with dist by @EvaristeGalois11 in #43
• Cache the engines between Scanner runs by @EvaristeGalois11 in #44
• Report a newer scanner CLI weekly by @EvaristeGalois11 in #45
• Say that the scanner CLI is pinned by @EvaristeGalois11 in #46
• Analyse any project with Sonar's scanner by @EvaristeGalois11 in #47
• Add npm and pnpm monorepo fixtures, and recreate node_modules links by @EvaristeGalois11 in #48
• Keep the Node fixtures' types on their Node major by @EvaristeGalois11 in #51
• Don't run dependencies' install scripts by @EvaristeGalois11 in #53
• Analyse this repository with its own action by @EvaristeGalois11 in #52
• Address Sonar's findings on this repository by @EvaristeGalois11 in #54
• Split the analysis's longest functions by @EvaristeGalois11 in #55
• Settle Sonar's remaining findings in the code by @EvaristeGalois11 in #56
• Mark the waits between retries too by @EvaristeGalois11 in #57
• Lint with the compiler's types and check the artifact's shape by @EvaristeGalois11 in #58
• Keep the runner's event out of the tests by @EvaristeGalois11 in #59
• Fuzz the analysis's trust boundary by @EvaristeGalois11 in #60
• Check for unused code and dependencies, and the lockfile's sources by @EvaristeGalois11 in #61
• Keep the badges users look for in the header by @EvaristeGalois11 in #62
• Check that the wrappers run on Windows by @EvaristeGalois11 in #63
• Test on macOS and Windows by @EvaristeGalois11 in #64
• Say that the build's artifact expires after a day by @EvaristeGalois11 in #65
• List the supported projects and runners, and what is tested by @EvaristeGalois11 in #66
• Refuse file names that aren't valid UTF-8 by @EvaristeGalois11 in #67
• Resolve paths as the system does by @EvaristeGalois11 in #68
• Keep the token from builds that shouldn't have it by @EvaristeGalois11 in #69
• Map .js imports to .ts with ts-jest's own setting by @EvaristeGalois11 in #70
• Refuse a module base inside .git, and check the CLI's placeholders by @EvaristeGalois11 in #71
• Keep the scanner's zip, checked on every use, and unpack it per job by @EvaristeGalois11 in #72
• Check dist without ignoring whitespace at line ends by @EvaristeGalois11 in #73
• Bring the docs in line with the code by @EvaristeGalois11 in #75
• Move to the galois-groups organization by @EvaristeGalois11 in #78
• Trap what the fixture wrappers need instead of the wrappers by @EvaristeGalois11 in #79
• Bump org.apache.maven:apache-maven from 3.9.16 to 3.10.0 in /fixtures/maven in the maven group across 1 directory by @dependabot[bot] in #77
• Build with Vite and test with Vitest by @EvaristeGalois11 in #81
• Say what untested means for the token by @EvaristeGalois11 in #86
• Tighten the analysis of untrusted runs by @EvaristeGalois11 in #87
• Make the docs promise only what the code does by @EvaristeGalois11 in #88
• Fetch the pull request's commit from this repository by @EvaristeGalois11 in #89
• Add a fixture for every file type the fork path will analyse by @EvaristeGalois11 in #90
• Name the Gradle fixture's buildSrc project by @EvaristeGalois11 in #91
• Analyse only tested languages on the fork path by @EvaristeGalois11 in #92
• Split the docs into one page per reader by @EvaristeGalois11 in #93
• Run the scanner only for projects with sonar-project.properties by @EvaristeGalois11 in #96
• Use the checkout the workspace holds instead of a checkout input by @EvaristeGalois11 in #97
• List SonarQube's build system autoconfiguration as reviewed by @EvaristeGalois11 in #99
• Analyse Terraform, Bicep and the formats iac finds by content on the fork path by @EvaristeGalois11 in #98
• Analyse shell scripts, PowerShell and Mule applications on the fork path by @EvaristeGalois11 in #100
• Turn languages off with a relative pattern by @EvaristeGalois11 in #101
• Clear the analyses' own warnings by @EvaristeGalois11 in #102
• Check every program the fork-path analyses start by @EvaristeGalois11 in #103
• Share the fork-path analysis between the fixture workflows by @EvaristeGalois11 in #104
• Gather the samples of other file types into an infra fixture by @EvaristeGalois11 in #106
• Run Sonar's npm scanner for Node projects by @EvaristeGalois11 in #107
• Stop recommending a scanner cache in the Sonar workflow by @EvaristeGalois11 in #108
• Name Node projects in the action description by @EvaristeGalois11 in #110
• Set the shared fork-path workflow's permissions by @EvaristeGalois11 in #111
• Move the major tag to each new release by @EvaristeGalois11 in #112
• Add a release badge and centre the README header by @EvaristeGalois11 in #113
• Bump gradle-wrapper from 9.8.0 to 9.8.1 in /fixtures/gradle in the gradle group by @dependabot[bot] in #115
• Bump the npm group with 6 updates by @dependabot[bot] in #116
• Bump the github-actions group with 3 updates by @dependabot[bot] in #117
• Finish the README for the release by @EvaristeGalois11 in #114

Full Changelog: v1.3.0...v2.0.0