[DEVEX-1727] Add reusable SonarQube manual-scan workflow - #159
Conversation
Add workflow_call workflow with quality_profile input, optional coverage artifact download from a prior run, and Sonar scanner cache. DEVEX-1727 Co-authored-by: Cursor <cursoragent@cursor.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Switch quality profiles via SonarCloud API instead of unsupported scanner args, remove Docker-era coverage path rewrite, and require an explicit coverage artifact pattern when downloading from a prior run. DEVEX-1727 Co-authored-by: Cursor <cursoragent@cursor.com>
Drop coverage artifact download and revert README changes. This workflow is for on-demand security profile scans only. DEVEX-1727 Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4547cf3. Configure here.
| "https://sonarcloud.io/api/qualityprofiles/add_project" \ | ||
| --data-urlencode "project=${{ steps.sonar_profile.outputs.project_key }}" \ | ||
| --data-urlencode "qualityProfile=${{ steps.sonar_profile.outputs.previous_profile }}" \ | ||
| --data-urlencode "language=${{ inputs.sonar_language }}" |
There was a problem hiding this comment.
Racy quality profile restore
Medium Severity
The workflow reads the current SonarCloud profile, switches it for the scan, then restores it, with no concurrency guard. Overlapping manual runs—or a normal CI Sonar scan in the same window—can capture another run’s temporary profile and restore that instead, leaving the project stuck on the wrong profile.
Reviewed by Cursor Bugbot for commit 4547cf3. Configure here.
|
Closing for now — SonarCloud profile switching via API has concurrency/race risks with normal CI scans, and SonarCloud has no UI trigger for on-demand analysis. The simpler path is: disable slow taint rules on the default CI profile + use review-code-security for PR coverage. Can revisit a minimal workflow_dispatch (no API profile mutation) later if needed. DEVEX-1727 |
1 participant
Summary
sonarqube-manual.yamlreusable workflow for on-demand SonarCloud scans with a configurable quality profile~/.sonar/cacheto speed up repeated manual scansJIRA
https://revolutionparts.atlassian.net/browse/DEVEX-1727
Merge order
Merge this PR before encodium/common#TBD (consumer wrapper references
@main).Test plan
Sonar waycoverage_workflow_run_idfrom a recent unit_tests runMade with Cursor