ci: add SonarCloud analysis for the monorepo - #272
Merged
Conversation
Configure a single SonarCloud project covering all packages in the monorepo, adapted from the archived snap-solana-wallet setup.
Collect and upload lcov reports from the test matrix (one Node version) with repo-root-relative paths, and enable coverage collection for the Stellar snap.
Reusable workflow that downloads per-package lcov artifacts and uploads a CI-based analysis, called from main.yml on same-repo PRs and pushes to main. Non-blocking for now (not part of all-jobs-complete).
Battambang
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Pass the package directory through an env var instead of inline `${{ }}`
expansion in the `run` block, addressing the zizmor code-injection finding.
Pin actions/upload-artifact and actions/download-artifact to their v7 hashes to satisfy the repo blanket policy for unpinned action references.
Move pull-requests and checks write permissions from the workflow level into the sonarcloud-scan job to satisfy the zizmor overly-broad- permissions findings.
gabrieledm
previously approved these changes
Sep 4, 2026
Battambang
enabled auto-merge
September 4, 2026 13:43
Battambang
disabled auto-merge
September 4, 2026 13:53
Battambang
enabled auto-merge
September 4, 2026 13:53
ulissesferreira
previously approved these changes
Sep 4, 2026
mikesposito
previously approved these changes
Sep 4, 2026
Battambang
disabled auto-merge
September 4, 2026 14:22
Battambang
enabled auto-merge
September 4, 2026 14:22
The `uses:` caller job must explicitly grant the write scopes the reusable sonarcloud.yml workflow requests (pull-requests, checks). Removing them in 07d8201 made the Main workflow fail at startup, so "All jobs pass" never reported. Restore them at the job level (not workflow level) to keep the zizmor overbroad-permissions finding resolved.
Battambang
dismissed stale reviews from ulissesferreira and mikesposito
via
September 4, 2026 14:48
845ff79
Single-file artifact uploads drop the source directory, and merge-multiple flattened all lcov.info files into packages/, so the scan found no coverage. Download each artifact into its own folder and move it back to packages/<dir>/coverage/lcov.info to match sonar.javascript.lcov.reportPaths.
|
mikesposito
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
The archived snap-solana-wallet repo used SonarCloud to analyze every PR (the
sonarqubecloudbot comment with quality gate, issues, coverage, and duplication). After migrating to this monorepo, that analysis was lost. The SonarCloud projectMetaMask_internal-snapsand GitHub App have been set up, but the project currently runs Automatic Analysis, which cannot import coverage and does not read any in-repo configuration.This PR switches the repo to CI-based analysis, matching the pattern used by metamask-extension and metamask-mobile:
sonar-project.properties— one SonarCloud project covering all published packages underpackages/.sample-snapis excluded (private hello-world fixture not in the CI test matrix), along with tests, build artifacts, images, snapshots, and mocks. TheprojectKeyisMetaMask_internal-snaps, confirmed against the live PR decoration.testjob inlint-build-test.ymlnow rewrites Jest's package-relativeSF:paths to repo-root-relative paths and uploadspackages/<dir>/coverage/lcov.infoas a per-package artifact, but only for one Node version (22.x) so lcov files are never merged across runs.stellar-wallet-snapnow collects coverage (collectCoverage: true); the other packages already did.sonarcloud.ymlworkflow — downloads the coverage artifacts and runsSonarSource/sonarqube-scan-action(v7.1.0, SHA-pinned, same as extension) withfetch-depth: 0. Called frommain.ymlon same-repo PRs and pushes tomain; skipped for forks (noSONAR_TOKEN) and merge-queue commits.The scan is deliberately non-blocking: it is not part of
all-jobs-complete, so a SonarCloud outage cannot block merges.References
sonar-project.propertiesand its sonarcloud.ymlChecklist