Conversation
Declares the org.sonarqube plugin in the root build and applies a new gradle/sonar.gradle convention to every spring-* module so each one is analyzed as its own SonarQube project keyed org.springframework:<module>, instead of a single aggregated scan of the whole build. Adds .github/workflows/sonar.yml, a matrix workflow running one scan job per sub-module. Server URL and token are read from the SONAR_HOST_URL and SONAR_TOKEN environment variables rather than being hardcoded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduces a separate, project-specific SonarQube analysis for every
spring-*sub-module, rather than one aggregated scan of the whole build.What changed
build.gradle— declares theorg.sonarqubeplugin (7.4.0.8496, the first line supporting Gradle 9) withapply false, and applies the new convention script tomoduleProjects.gradle/sonar.gradle(new) — applies the SonarQube plugin per module so each one is its own standalone SonarQube project, withsonar.projectKeyoforg.springframework:<module>, a project name derived from the module description, and the module's version. The plugin is deliberately not applied at the root, which would collapse everything into a single aggregated analysis..github/workflows/sonar.yml(new) — a matrix workflow with one job per sub-module, so each module's scan reports independently.Scope
Only the
spring-*library modules are scanned.framework-api,framework-bom,framework-docs,framework-platformandintegration-testsare excluded.Configuration required
The build script hardcodes no server details. Add these repository secrets before the workflow can report:
SONAR_HOST_URLSONAR_TOKENEach module's project must exist on the server (or auto-provisioning must be enabled) under its
org.springframework:<module>key.Created by a Sourcegraph agentic batch change.