fix: ajusta autenticação SonarCloud e tolera falhas do Qodana#107
Conversation
- Usa SONARQUBE_TOKEN com fallback para SONAR_TOKEN - Substitui sonar.login deprecado por sonar.token - Adiciona continue-on-error no Qodana para não bloquear o pipeline Co-Authored-By: Afonso Dutra Nogueira Filho <afonsoft@gmail.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
📝 Info: SonarQube status in security summary is not tracked in needs
The security-summary job (.github/workflows/security-scan.yml:154-169) reports SonarQube status via contains(needs.*.result, 'skipped'), but the sonarqube job is not listed in needs: [codeql, snyk]. This is pre-existing and untouched by this PR, so the SonarQube column may always read 'N/A' unless codeql/snyk happen to be skipped. Not a regression from this PR.
(Refers to lines 157-169)
Was this helpful? React with 👍 or 👎 to provide feedback.
| - name: 🗄️ Setup .NET | ||
| env: | ||
| SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN || secrets.SONAR_TOKEN }} | ||
| uses: actions/setup-dotnet@v5 | ||
| with: | ||
| dotnet-version: "10.0.x" |
There was a problem hiding this comment.
📝 Info: SONAR_TOKEN env on Setup .NET step is unused
The env: SONAR_TOKEN block added to the 🗄️ Setup .NET step (.github/workflows/code-quality.yml:64-65 and .github/workflows/security-scan.yml:94-95) has no effect: actions/setup-dotnet does not consume SONAR_TOKEN, and step-level env does not propagate to other steps. It is harmless dead configuration, likely a copy-paste artifact, but could be removed to avoid confusion. The functional token usage is correctly scoped to the Prepare/Run analysis steps.
Was this helpful? React with 👍 or 👎 to provide feedback.
- Atualiza badges de build, code quality, security scan, NuGet e SonarCloud - Corrige URL do Star History para api.star-history.com/svg - Sincroniza README.md e README.pt-br.md Co-Authored-By: Afonso Dutra Nogueira Filho <afonsoft@gmail.com>
Qodana Community for .NET10 new problems were found
💡 Qodana analysis was run in the pull request mode: only the changed files were checked View the detailed Qodana reportTo be able to view the detailed Qodana report, you can either:
To get - name: 'Qodana Scan'
uses: JetBrains/qodana-action@v2026.1.3
with:
upload-result: trueContact Qodana teamContact us at qodana-support@jetbrains.com
|
- Remove SONAR_TOKEN do step Setup .NET (não consumido) - Inclui sonarqube no security-summary Co-Authored-By: Afonso Dutra Nogueira Filho <afonsoft@gmail.com>
|
1 participant
All Submissions:
Changes to Core Features:
Summary
Corrige as falhas de autenticação do SonarCloud observadas nos runs:
Changes
SONAR_TOKENporSONARQUBE_TOKEN(com fallback paraSONAR_TOKEN) e substitui o parâmetro deprecadosonar.loginporsonar.token.continue-on-error: truepara evitar que falhas de baseline/limiar interrompam o pipeline de code quality.Verification
python3 -c "import yaml".SONARQUBE_TOKENfoi testado contra a API do SonarCloud e está ativo.Link to Devin session: https://app.devin.ai/sessions/215d612adf5b43a3ac4b055476bbc859
Requested by: @afonsoft