From 2b3ddc6bc5dc33648791cc8a149438f6468614cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB?= Date: Fri, 28 Aug 2026 20:41:58 +0400 Subject: [PATCH 1/4] ci: add SonarQube quality gate --- .github/workflows/ci.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c61fc2a..bdbfa64 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,11 +22,22 @@ jobs: registry-user: ${{ secrets.REGISTRY_USER }} registry-token: ${{ secrets.REGISTRY_TOKEN }} + sonar: + needs: tests + uses: PANiXiDA-Infrastructure/ci-cd/.github/workflows/dotnet-sonar.yml@main + with: + project-key: ${{ vars.SONAR_PROJECT_KEY }} + secrets: + sonar-token: ${{ secrets.SONAR_TOKEN }} + registry-user: ${{ secrets.REGISTRY_USER }} + registry-token: ${{ secrets.REGISTRY_TOKEN }} + publish: if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} needs: - format - tests + - sonar uses: PANiXiDA-Infrastructure/ci-cd/.github/workflows/dotnet-publish-global-nuget.yml@main secrets: NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }} From b83343f9e62a5b148e1e7b28d4159e6676d182a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB?= Date: Fri, 28 Aug 2026 21:11:29 +0400 Subject: [PATCH 2/4] ci: harden SonarQube workflow --- .github/workflows/ci.yml | 1 + README.md | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bdbfa64..99616bb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,6 +23,7 @@ jobs: registry-token: ${{ secrets.REGISTRY_TOKEN }} sonar: + if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} needs: tests uses: PANiXiDA-Infrastructure/ci-cd/.github/workflows/dotnet-sonar.yml@main with: diff --git a/README.md b/README.md index 6dc66cc..e9cfd05 100644 --- a/README.md +++ b/README.md @@ -281,6 +281,20 @@ dotnet test --configuration Release dotnet pack --configuration Release ``` +### Continuous integration + +Pull requests from branches in this repository run formatting, tests, and +SonarQube analysis. Publishing from `main` starts only after the SonarQube +Quality Gate succeeds. + +Before enabling this workflow, add the repository to the +[shared SonarQube inventory](https://github.com/panixida-infrastructure/core-platform/blob/main/inventory/sonarqube/repositories.json). +Reconciliation provisions the `SONAR_PROJECT_KEY` repository variable and the +`SONAR_TOKEN` repository secret; `SONAR_HOST_URL` is configured at the +organization level. GitHub does not expose repository secrets to pull requests +from forks, so SonarQube analysis is skipped for those pull requests while +formatting and tests continue to run. + ## Tooling This repository uses: From 21045447cb2e6cdd52c140882efe8e05e2fe3567 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB?= Date: Fri, 28 Aug 2026 21:15:31 +0400 Subject: [PATCH 3/4] ci: require SonarQube for all pull requests --- .github/workflows/ci.yml | 1 - AGENTS.md | 9 +++++++++ README.md | 6 ++---- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 99616bb..bdbfa64 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,6 @@ jobs: registry-token: ${{ secrets.REGISTRY_TOKEN }} sonar: - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} needs: tests uses: PANiXiDA-Infrastructure/ci-cd/.github/workflows/dotnet-sonar.yml@main with: diff --git a/AGENTS.md b/AGENTS.md index 722d98f..2c9e4b7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -72,6 +72,15 @@ Before considering work complete, run: - `dotnet build --configuration Release` - `dotnet test --configuration Release` +## Continuous integration + +- SonarQube analysis is mandatory for every pull request and push to `main`. +- The `sonar` job must run after tests, and `publish` must depend on the + successful SonarQube Quality Gate. +- Do not make SonarQube conditional or allow its failures to be ignored. +- Keep `README.md` aligned with the required `SONAR_PROJECT_KEY`, `SONAR_TOKEN`, + and organization-level `SONAR_HOST_URL` configuration. + ## Packaging and versioning - Package metadata must stay complete and consistent. diff --git a/README.md b/README.md index e9cfd05..9b04d4d 100644 --- a/README.md +++ b/README.md @@ -283,7 +283,7 @@ dotnet pack --configuration Release ### Continuous integration -Pull requests from branches in this repository run formatting, tests, and +Every pull request and push to `main` runs formatting, tests, and mandatory SonarQube analysis. Publishing from `main` starts only after the SonarQube Quality Gate succeeds. @@ -291,9 +291,7 @@ Before enabling this workflow, add the repository to the [shared SonarQube inventory](https://github.com/panixida-infrastructure/core-platform/blob/main/inventory/sonarqube/repositories.json). Reconciliation provisions the `SONAR_PROJECT_KEY` repository variable and the `SONAR_TOKEN` repository secret; `SONAR_HOST_URL` is configured at the -organization level. GitHub does not expose repository secrets to pull requests -from forks, so SonarQube analysis is skipped for those pull requests while -formatting and tests continue to run. +organization level. ## Tooling From 44d45dc9eba235cba710521efed382fbb7d26160 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB?= Date: Fri, 28 Aug 2026 21:32:23 +0400 Subject: [PATCH 4/4] docs: simplify SonarQube guidance --- AGENTS.md | 2 -- README.md | 6 ------ 2 files changed, 8 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 2c9e4b7..7776dd9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -78,8 +78,6 @@ Before considering work complete, run: - The `sonar` job must run after tests, and `publish` must depend on the successful SonarQube Quality Gate. - Do not make SonarQube conditional or allow its failures to be ignored. -- Keep `README.md` aligned with the required `SONAR_PROJECT_KEY`, `SONAR_TOKEN`, - and organization-level `SONAR_HOST_URL` configuration. ## Packaging and versioning diff --git a/README.md b/README.md index 9b04d4d..65f94f9 100644 --- a/README.md +++ b/README.md @@ -287,12 +287,6 @@ Every pull request and push to `main` runs formatting, tests, and mandatory SonarQube analysis. Publishing from `main` starts only after the SonarQube Quality Gate succeeds. -Before enabling this workflow, add the repository to the -[shared SonarQube inventory](https://github.com/panixida-infrastructure/core-platform/blob/main/inventory/sonarqube/repositories.json). -Reconciliation provisions the `SONAR_PROJECT_KEY` repository variable and the -`SONAR_TOKEN` repository secret; `SONAR_HOST_URL` is configured at the -organization level. - ## Tooling This repository uses: