eu07/maszyna
17
0
Fork 0
mirror of https://github.com/MaSzyna-EU07/maszyna.git synced 2026-10-17 15:39:20 +02:00
Code Issues 151 Wiki Activity

fix: sonar sast fixes - sonar.yml, nosonar, linux chmod modification

Browse Source
This commit is contained in:
jerrrrycho
2026-09-28 21:07:53 +02:00
committed by GitHub
parent 8fbb482350
commit 4137f5504a
7 changed files with 36 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
.github/workflows/sonar.yml vendored
View File

@@ -70,7 +70,9 @@ jobs:
pull-requests: read # verify PR head sha via the API
env:
BUILD_WRAPPER_OUT_DIR: bw-output
SONAR_EXCLUSIONS: betterRenderer/**,ref/**,imgui/**,stb/**,build/**,bw-output/**
# .trusted/ holds the checkout of master used to restore the scanner config;
# it is not part of the analysed change.
SONAR_EXCLUSIONS: betterRenderer/**,ref/**,imgui/**,stb/**,build/**,bw-output/**,.trusted/**
SONAR_SCANNER_JAVA_OPTS: -Xmx5g
steps:
- name: Post pending status
@@ -102,12 +104,26 @@ jobs:
- name: Unpack analysis input
run: |
set -euo pipefail
# The archive holds the whole PR workspace and is unpacked over this one,
# .trusted/ included. Move the trusted config out of reach first, or a PR
# carrying its own .trusted/sonar-project.properties would have it planted
# here and restored below as if it came from master.
if [ -f "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" ]; then
cp "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" /tmp/trusted-sonar-project.properties
fi
# Nothing may be written outside the workspace: reject absolute members and
# any member reaching through a parent directory before unpacking anything.
tar -tzf /tmp/sonar-input/workspace.tar.gz > /tmp/archive-members.txt
if grep -qE '^/|(^|/)[.][.](/|$)' /tmp/archive-members.txt; then
echo "::error::archive contains paths outside the workspace"
exit 1
fi
tar -xzf /tmp/sonar-input/workspace.tar.gz -C "$GITHUB_WORKSPACE"
# Strip PR-controlled scanner configuration, restore the trusted one.
rm -f "$GITHUB_WORKSPACE/sonar-project.properties" \
"$GITHUB_WORKSPACE/.sonarcloud.properties"
if [ -f "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" ]; then
cp "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" "$GITHUB_WORKSPACE/"
if [ -f /tmp/trusted-sonar-project.properties ]; then
cp /tmp/trusted-sonar-project.properties "$GITHUB_WORKSPACE/sonar-project.properties"
fi
- name: Resolve and verify PR metadata