mirror of
https://github.com/formbricks/formbricks.git
synced 2026-01-06 05:40:02 -06:00
aecedfd082
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Dhruwang Jariwala <67850763+Dhruwang@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Dhruwang <dhruwangjariwala18@gmail.com> Co-authored-by: Matthias Nannt <mail@matthiasnannt.com>
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
name: SonarQube
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
merge_group:
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
sonarqube:
|
|
name: SonarQube
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
|
|
|
|
- name: Setup Node.js 20.x
|
|
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
|
|
with:
|
|
node-version: 20.x
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --config.platform=linux --config.architecture=x64
|
|
|
|
- name: create .env
|
|
run: cp .env.example .env
|
|
|
|
- name: Generate Random ENCRYPTION_KEY, CRON_SECRET & NEXTAUTH_SECRET and fill in .env
|
|
run: |
|
|
RANDOM_KEY=$(openssl rand -hex 32)
|
|
sed -i "s/ENCRYPTION_KEY=.*/ENCRYPTION_KEY=${RANDOM_KEY}/" .env
|
|
sed -i "s/CRON_SECRET=.*/CRON_SECRET=${RANDOM_KEY}/" .env
|
|
sed -i "s/NEXTAUTH_SECRET=.*/NEXTAUTH_SECRET=${RANDOM_KEY}/" .env
|
|
|
|
- name: Run tests with coverage
|
|
run: |
|
|
cd apps/web
|
|
pnpm test:coverage
|
|
cd ../../
|
|
# The Vitest coverage config is in your vite.config.mts
|
|
|
|
- name: SonarQube Scan
|
|
uses: SonarSource/sonarqube-scan-action@bfd4e558cda28cda6b5defafb9232d191be8c203
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|