Conversation
Configures the org.sonarqube plugin so each spring-* sub-module is analyzed as its own SonarQube project keyed org.springframework:<module>, rather than as a single aggregated scan of the whole build. Each module's configuration lives in its own build file so it can be reviewed and merged independently. Server URL and token are read from the SONAR_HOST_URL and SONAR_TOKEN environment variables rather than being hardcoded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of giving every
spring-*sub-module its own SonarQube project. This work is split so each sub-module lands as an independent changeset, plus this one for the shared scan workflow.Design
Each sub-module declares the
org.sonarqubeplugin (7.4.0.8496, the first release supporting Gradle 9) directly in its own<module>/<module>.gradlefile and setssonar.projectKeytoorg.springframework:<module>. Nothing is added to the root build or togradle/, so every sub-module changeset is self-contained and can merge independently, in any order.framework-api,framework-bom,framework-docs,framework-platformandintegration-testsare out of scope.Configuration required
No server details are hardcoded. These repository secrets are needed before any scan can report:
SONAR_HOST_URLSONAR_TOKENEach module's project must exist on the server, or auto-provisioning must be enabled, under its
org.springframework:<module>key.The scan workflow runs one job per sub-module, so merge it after the module changesets it references.
Created by a Sourcegraph agentic batch change.