mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-23 15:36:33 +00:00
Maurice
6fe5009c20
Review feedback on #2038: the root already has a script that does all of this, so the five jobs and the artifact shuffling between them were doing by hand what `npm run test:cov` does on its own. It ends with `--prefix plugin-sdk`, so all four packages are covered, and each writes its lcov to <pkg>/coverage/ — exactly where sonar.javascript.lcov.reportPaths looks. 131 lines become 28. Three things the plain root sequence still needs on a runner, kept as their own steps so the reason stays visible: - plugin-sdk is not a root workspace (workspaces = client, server, shared), so the root npm ci never reaches it and it needs its own. - The lockfile was generated on Windows and omits @swc/core's Linux optional binary, so the server's SWC transform cannot load. test.yml carries the same step for the same reason. - Only shared is built, not the root `build`. server and client run their suites from source through vitest, so building them adds a tsc pass and a full vite bundle that nothing here reads. The cost is wall-clock. The first run of the parallel version took 16 minutes, with client (11) and server (9) overlapping; sequentially that is closer to 25. Nobody waits on this job, so the simpler file is the better trade — but it is a trade, not a free win.
84 lines
3.5 KiB
YAML
84 lines
3.5 KiB
YAML
name: SonarQube
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Push to dev only, deliberately.
|
|
#
|
|
# The SonarQube instance is Community Edition, which has no branch or
|
|
# pull-request analysis: the project holds exactly one view. Analysing a feature
|
|
# branch would overwrite that view with the branch's numbers until somebody
|
|
# scanned dev again, so the one branch that may publish is the one everybody
|
|
# reads. workflow_dispatch stays available for a manual re-run.
|
|
on:
|
|
push:
|
|
branches: [dev]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
scan:
|
|
name: Coverage & Scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
# Sonar reads git blame to date each issue and to decide what counts as
|
|
# new code. A shallow clone leaves it blind to both.
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 24
|
|
cache: npm
|
|
cache-dependency-path: package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Install plugin-sdk dependencies
|
|
# plugin-sdk is not a root workspace (workspaces = client, server, shared)
|
|
# — it ships as its own npm package with its own lockfile, so the root
|
|
# npm ci does not reach it. Its coverage is part of test:cov all the same.
|
|
run: cd plugin-sdk && npm ci
|
|
|
|
- name: Ensure @swc/core's Linux binary for unplugin-swc
|
|
# Same reason as test.yml: the lockfile was generated on Windows and omits
|
|
# @swc/core's Linux optional native binary, so npm ci skips it on the
|
|
# runner and the server's SWC transform cannot load.
|
|
run: |
|
|
SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
|
|
npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
|
|
|
|
- name: Build shared
|
|
# Only shared, not the root `build`. server and client run their suites
|
|
# from source through vitest, so building them would add a tsc pass and a
|
|
# full vite bundle that nothing here reads.
|
|
run: npm run build --workspace=shared
|
|
|
|
- name: Run tests with coverage
|
|
# One script for all four packages — it already ends with
|
|
# `--prefix plugin-sdk`. Each writes lcov to <pkg>/coverage/, which is
|
|
# where sonar.javascript.lcov.reportPaths looks. Without those files every
|
|
# line reports as uncovered and the dashboard shows a collapse that did
|
|
# not happen, so this step failing has to stop the scan rather than let it
|
|
# publish a false number.
|
|
run: npm run test:cov
|
|
|
|
- name: Scan
|
|
uses: SonarSource/sonarqube-scan-action@v8
|
|
env:
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
|
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
|
|
with:
|
|
# New Code is configured as "previous version", so this string is what
|
|
# draws that line — changing it re-bases every "new code" metric.
|
|
# Pinned rather than read from package.json on purpose: package.json is
|
|
# still on 3.4.1 while the project has been analysed as 4.0.0 all along,
|
|
# and taking the lower number would silently move the baseline. Bump it
|
|
# here as part of the release, together with the version bump.
|
|
#
|
|
# Everything else — sources, tests, exclusions, the documented
|
|
# false-positive list — lives in sonar-project.properties so it stays
|
|
# reviewable in a PR rather than buried in workflow YAML.
|
|
args: -Dsonar.projectVersion=4.0.0
|