coro-cpp/.github/workflows/sonarcloud.yml at master · sjinks/coro-cpp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
name: SonarCloud
on:
  push:
    branches:
      - master
  pull_request:
    types:
      - opened
      - synchronize
      - reopened

permissions:
  contents: read

jobs:
  build:
    name: Build and analyze
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
        with:
          egress-policy: audit
          allowed-endpoints:
            analysis-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
            api.github.com:443
            api.nuget.org:443
            api.sonarcloud.io:443
            azure.archive.ubuntu.com:80
            binaries.sonarsource.com:443
            cli.codecov.io:443
            esm.ubuntu.com:443
            github.com:443
            ingest.codecov.io:443
            keybase.io:443
            motd.ubuntu.com:443
            o26192.ingest.us.sentry.io:443
            packages.microsoft.com:443
            scanner.sonarcloud.io:443
            sonarcloud.io:443
            storage.googleapis.com:443

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Install dependencies
        uses: ./.github/actions/install-dependencies

      - name: Generate compilation database
        run: cmake -B build -DCMAKE_BUILD_TYPE=Coverage -DCMAKE_CXX_COMPILER=clang++

      - name: Generate coverage report
        run: cmake --build build --target coverage -j $(nproc)

      - name: Run sonar-scanner
        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0
        with:
          args: >
            --define sonar.cfamily.compile-commands=build/compile_commands.json
            --define sonar.coverageReportPaths=build/coverage/coverage.xml
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: build/coverage/coverage.lcov