Skip to content

[None][infra] Add SonarQube code analysis in github action #10677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yuanjingx87 wants to merge 3 commits into from
Closed

[None][infra] Add SonarQube code analysis in github action #10677

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e9f8f2e
Add SonarQube scanning in github action
yuanjingx87 Jan 13, 2026
aa5c314
Add action for sonarqube for testing
yuanjingx87 Jan 14, 2026
436edef
Run on self-hosted machine for SonarQube Scanning
yuanjingx87 Jan 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/blossom-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,7 +379,19 @@
args2: ${{ fromJson(needs.Authorization.outputs.args).args2 }}
args3: ${{ fromJson(needs.Authorization.outputs.args).args3 }}

SonarQube-scan:
name: SnoarQube scan
needs: [Authorization]
runs-on: blossom
steps:
- name: Run SonarQube Code Analysis
uses: SonarSource/sonarqube-scan-action@v4
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}


Job-trigger:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
name: Start ci job
needs: [Vulnerability-scan]
runs-on: blossom
Expand Down
36 changes: 36 additions & 0 deletions .github/workflows/sonarqube-code-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: SonarQube

on:
push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened]
workflow_dispatch:
inputs:
ref:
description: 'commit sha to check'
required: true

jobs:
build:
name: Build and analyze
runs-on: blossom

@tburt-nv tburt-nv Jan 14, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We probably won't be able to use the blossom runner for these actions, since they have some special configuration designed to work only with the blossom workflow. I think the standard ubuntu-latest runner should work for this, unless the SonarQube server requires special network access.

@yuanjingx87 yuanjingx87 Jan 14, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this needs to hit internal sonarqube API like: https://sonar.nvidia.com/api/server/version
I closed this PR for now and play with it in my fork, now I set up a new runner with my dev-box in my fork to get it running

steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}

- uses: SonarSource/sonarqube-scan-action@v4
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
# If you wish to fail your job when the Quality Gate is red, uncomment the
# following lines. This would typically be used to fail a deployment.
# We do not recommend to use this in a pull request. Prefer using pull request
# decoration instead.
# - uses: SonarSource/sonarqube-quality-gate-action@v1
# timeout-minutes: 5
# env:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
Comment thread Fixed
Comment thread Fixed
Comment thread Fixed
Comment on lines +17 to +36

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 10 months ago

In general, the fix is to explicitly declare a permissions: block so the GITHUB_TOKEN has only the minimal access required. For this job, it only needs to read repository contents and metadata for analysis, so setting contents: read is appropriate. This can be done either at the workflow root (applies to all jobs) or at the job level (just for build). Since CodeQL flags the job, the clearest fix is to add permissions: under jobs.build.

Concretely, in .github/workflows/sonarqube-code-analysis.yml, add a permissions: section under jobs.build (between runs-on: blossom and steps:), indented two spaces further than build:. Set contents: read inside it. No imports or additional methods are needed; this is purely a YAML configuration change and will not alter existing step behavior, except that it tightens the default token privileges.

Suggested changeset 1
.github/workflows/sonarqube-code-analysis.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/sonarqube-code-analysis.yml b/.github/workflows/sonarqube-code-analysis.yml
--- a/.github/workflows/sonarqube-code-analysis.yml
+++ b/.github/workflows/sonarqube-code-analysis.yml
@@ -16,6 +16,8 @@
   build:
     name: Build and analyze
     runs-on: blossom
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
         with:
EOF
@@ -16,6 +16,8 @@
build:
name: Build and analyze
runs-on: blossom
permissions:
contents: read
steps:
- uses: actions/checkout@v6
with:
Copilot is powered by AI and may make mistakes. Always verify output.
1 change: 1 addition & 0 deletions sonar-project.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
sonar.projectKey=GPUSW_TensorRT-LLM-Team_TensorRT-LLM_tensorrt-llm
Loading