fix(ci): skip SonarQube scan for dependabot-triggered PRs - #203
Open
syed-awsaf-informed wants to merge 2 commits into
Open
fix(ci): skip SonarQube scan for dependabot-triggered PRs#203syed-awsaf-informed wants to merge 2 commits into
syed-awsaf-informed wants to merge 2 commits into
Conversation
Contributor
✅ OSS Checks PassedAll tracked OSS checks passed in this run.
Results from commit 4d7467e, view the full job summary ♻️ This comment has been updated with latest results. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Maven GitHub Actions workflow to avoid failing Dependabot-authored PR runs by separating the JaCoCo-producing mvn verify step from the SonarQube scan and skipping the scan when the actor is dependabot[bot].
Changes:
- Split SonarQube scanning out of the “Code Coverage” step into a dedicated “SonarQube Scan” step.
- Add a conditional guard to skip the SonarQube scan on Dependabot-triggered PRs while still running
mvn verifyto produce the JaCoCo report.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+57
to
+60
| - name: Code Coverage | ||
| env: | ||
| GH_PACKAGES_PAT: ${{ secrets.GH_PACKAGES_PAT }} | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_N3 }} | ||
| run: ./mvnw $MAVEN_CLI_OPTS verify -Dsonar.projectKey=National-Node-Net_federator -Dsonar.organization=national-node-net -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml org.sonarsource.scanner.maven:sonar-maven-plugin:sonar | ||
| run: ./mvnw $MAVEN_CLI_OPTS verify |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot PRs don't get access to repo secrets, so the SonarQube scan step was failing every time trying to use
SONAR_TOKEN_N3. This skips the scan step for Dependabot PRs.