FerrisScript/.github/workflows/code-scanning.yml at main · dev-parkins/FerrisScript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: Code Scanning & Coverage
on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  # Generate coverage for all branches (PRs + main)
  # Codecov tracks coverage trends across all branches
  coverage:
    name: Generate Coverage Report
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921
        with:
            toolchain: stable
            components: rustfmt, clippy

      - name: Install tarpaulin
        run: cargo install cargo-tarpaulin

      - name: Generate Rust coverage
        run: cargo tarpaulin --workspace --out Xml --out Lcov --output-dir coverage

      - name: Setup Node.js for TypeScript tests
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install TypeScript dependencies
        working-directory: extensions/vscode
        run: npm ci

      - name: Run TypeScript tests with coverage
        working-directory: extensions/vscode
        run: npm run test:ci

      - name: Upload coverage reports as artifacts
        uses: actions/upload-artifact@v4
        with:
          name: coverage-reports
          path: |
            coverage/cobertura.xml
            coverage/lcov.info
            extensions/vscode/coverage/lcov.info
          retention-days: 7

      - name: Upload Rust coverage to Codecov
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.6.0
        with:
          files: ./coverage/cobertura.xml
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false
          flags: rust

      - name: Upload TypeScript coverage to Codecov
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.6.0
        with:
          files: ./extensions/vscode/coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false
          flags: typescript

  # SonarQube runs ONLY on main branch merges
  # SonarCloud only provides quality analysis for main branch, not feature branches
  sonarqube:
    name: SonarQube Quality Scan
    if: |
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: coverage  # Wait for coverage to be generated
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      # Download TypeScript coverage from coverage job
      - name: Download coverage reports
        uses: actions/download-artifact@v4
        with:
          name: coverage-reports
          path: coverage-artifacts

      - name: Move TypeScript coverage to expected location
        run: |
          mkdir -p extensions/vscode/coverage
          cp coverage-artifacts/extensions/vscode/coverage/lcov.info extensions/vscode/coverage/lcov.info

      # Note: SonarCloud does NOT support Rust language - cannot consume Rust coverage
      # See: docs/planning/technical/SONARCLOUD_RUST_LIMITATION_ANALYSIS.md
      # Rust coverage is handled by Codecov (primary tool for Rust)
      # TypeScript coverage is consumed via lcov.info (configured in sonar-project.properties)

      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}