sonar-check.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Sonar Quality Check
permissions:
  contents: read
  pull-requests: write
on:
  pull_request:
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
jobs:
  build:
    name: Sonar JaCoCo Coverage
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Setup Environment
        uses: ./.github/actions/setup-env
        with:
          install-python: 'true'
          install-apt-deps: 'true'
      - name: Cache SonarCloud packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Install Non-OSS
        uses: ./.github/actions/install-nonoss
      - name: Run Build and Tests with Coverage
        env:
          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
        run: mvn -B -T$(nproc) -P developer,systemvm,quality -Dsimulator -Dnoredist clean install
      - name: Upload to SonarQube
        if: github.repository == 'apache/cloudstack' && github.event.pull_request.head.repo.full_name == github.repository
        env:
          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          PR_ID: ${{ github.event.pull_request.number }}
          HEADREF: ${{ github.event.pull_request.head.ref }}
        run: |
          mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.pullrequest.key="$PR_ID" -Dsonar.pullrequest.branch="$HEADREF" -Dsonar.pullrequest.github.repository=apache/cloudstack -Dsonar.pullrequest.provider=GitHub -Dsonar.pullrequest.github.summary_comment=true
      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        if: github.repository == 'apache/cloudstack'
        with:
          files: ./client/target/site/jacoco-aggregate/jacoco.xml
          fail_ci_if_error: true
          flags: unittests
          verbose: true
          name: codecov
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: Compute Coverage Grade
        id: grade
        run: bash scripts/coverage-grade.sh client/target/site/jacoco-aggregate/jacoco.xml
      - name: Post Coverage Grade Comment on PR
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const grade     = '${{ steps.grade.outputs.coverage_grade }}';
            const label     = '${{ steps.grade.outputs.coverage_grade_label }}';
            const linePct   = '${{ steps.grade.outputs.line_coverage }}';
            const branchPct = '${{ steps.grade.outputs.branch_coverage }}';
            const emojiMap  = { A: '🟢', B: '🟡', C: '🟠', D: '🔴', F: '⛔' };
            const emoji     = emojiMap[grade] ?? '❓';
            const runUrl    = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            const marker    = '<!-- coverage-grade-bot -->';

            const branchRow = branchPct !== 'N/A'
              ? `| Branch coverage | **${branchPct}%** |`
              : '';

            const body = [
              marker,
              `## ${emoji} Test Coverage Grade: \`${grade}\` — ${label}`,
              '',
              '| Metric | Value |',
              '|--------|-------|',
              `| Line coverage   | **${linePct}%** |`,
              branchRow,
              '',
              '### Grade Scale',
              '| Grade | Line Coverage | Meaning |',
              '|-------|--------------|---------|',
              '| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |',
              '| 🟡 B | 60-79% | Good - almost there, don\'t stop now 😉 |',
              '| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |',
              '| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |',
              '| ⛔ F | < 20%  | Failing - tests? what tests? 🔥 |',
              '',
              '> Branch coverage is shown as a secondary signal. Grade is determined by **line coverage**.',
              `> [View full Actions run](${runUrl})`,
            ].filter(l => l !== undefined).join('\n');

            const { data: comments } = await github.rest.issues.listComments({
              owner:        context.repo.owner,
              repo:         context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.user.login === 'github-actions[bot]' && c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({
                owner:      context.repo.owner,
                repo:       context.repo.repo,
                comment_id: existing.id,
                body:       body,
              });
              console.log('Updated existing coverage grade comment');
            } else {
              await github.rest.issues.createComment({
                owner:        context.repo.owner,
                repo:         context.repo.repo,
                issue_number: context.issue.number,
                body:         body,
              });
              console.log('Posted coverage grade comment');
            }