advancedcsg/action-ccq repository overview

⁠Scan your code with SonarQube

Using this GitHub Action, scan your code with SonarQube to detects bugs, vulnerabilities and code smells.

⁠Requirements

• Have an SonarQube server.

⁠Usage

Project metadata, including the location to the sources to be analyzed, must be declared in the file sonar-project.properties in the base directory:

sonar.projectKey=myawesomeproject

sonar.sources=.

The workflow, usually declared in .github/workflows/build.yml, looks like:

on: push
name: Main Workflow
jobs:
  sonarQubeTrigger:
    name: SonarQube Trigger
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    - name: SonarQube Scan
      uses: advancedcsg-open/action-ccq@master
      env:
        SONARQUBE_URL: 'https://mysonar.url'
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}