You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/03/30 21:08:42 UTC
[PR] CAMEL-22752: Add SonarCloud PR analysis workflows [camel]
gnodet opened a new pull request, #22346:
URL: https://github.com/apache/camel/pull/22346
## Summary
Add two-workflow pattern for secure SonarCloud analysis on pull requests (including PRs from forks):
- **`sonar-build.yml`**: triggered on `pull_request`, builds the project with `mvn install -Dquickly` and uploads compiled classes + PR metadata as artifacts. No secrets needed.
- **`sonar-scan.yml`**: triggered on `workflow_run` completion of `SonarBuild`, downloads artifacts and runs `sonar:sonar` in the main repo context with access to `SONARCLOUD_TOKEN`.
This follows the same pattern used by [Apache Ignite (IGNITE-20466)](https://github.com/apache/ignite/blob/master/.github/workflows/sonar-pr-from-fork-scan.yml) and [Apache Kvrocks](https://github.com/apache/kvrocks/blob/unstable/.github/workflows/sonar.yaml) for safe SonarCloud analysis on fork PRs.
### How it works
1. PR is opened → `SonarBuild` runs (no secrets, just compiles and uploads artifacts)
2. `SonarBuild` completes → `Sonar Quality Pull Request Analysis` triggers via `workflow_run` (has access to `SONARCLOUD_TOKEN`)
3. SonarCloud decorates the PR with quality gate results and inline comments
### Prerequisites
- `SONARCLOUD_TOKEN` secret must be configured in the repository settings
- SonarCloud project `apache_camel` under the `apache` organization (already exists)
### Tested on
Validated end-to-end on [gnodet/camel#10](https://github.com/gnodet/camel/pull/10) — SonarCloud successfully posted quality gate results on the PR.
## Test plan
- [x] Tested on fork (gnodet/camel) with full build + scan chain
- [ ] Verify `SONARCLOUD_TOKEN` is available in apache/camel secrets
- [ ] Verify the workflow_run chain triggers correctly on apache/camel
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22752: Add SonarCloud PR analysis workflows [camel]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez commented on PR #22346:
URL: https://github.com/apache/camel/pull/22346#issuecomment-4160626723
CAMEL-22752 was closed, so, I don't understand the insistence of picking up closed issues and working on tasks that have clearly marked as no longer needed. In order to provide more context, I've created a new issue CAMEL-23274 where I explain which could be the potential alternative viable approaches: there are important constraints to evaluate though. However, the priority is lower and we have much more important tasks to dedicate our effort IMO.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23274: Add SonarCloud PR analysis workflows [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #22346:
URL: https://github.com/apache/camel/pull/22346#issuecomment-4175685184
One additional point worth noting: with the `sonar.pullrequest.*` parameters, SonarCloud operates in **PR analysis mode** — it only reports issues on new/changed code in the PR (the "Clean as You Code" approach), not on the entire codebase. So the concern about an exaggerated number of false positives shouldn't apply here.
_Claude Code on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23274: Add SonarCloud PR analysis workflows [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #22346:
URL: https://github.com/apache/camel/pull/22346#issuecomment-4175665408
Apologies for the confusion with CAMEL-22752 — I missed that it had been closed.
That said, I think this PR is actually a direct implementation of what CAMEL-23274 describes. The two-workflow `workflow_run` pattern (used by Apache Ignite and Kvrocks) addresses the main constraints you identified:
- **Token security**: the `SONAR_TOKEN` is only used in the second workflow, which runs in the main repo context via `workflow_run` — fork code never has access to it
- **Execution time**: tested end-to-end on [gnodet/camel#10](https://github.com/gnodet/camel/pull/10) — build ~12 min, scan ~16 min (~28 min total, not hours)
- **Infrastructure**: uses the existing SonarCloud project (`apache_camel`) and `SONAR_TOKEN` secret — no Docker/local server needed
Happy to discuss if you see issues with this approach or if the priority doesn't justify it right now. This is a draft PR, so no rush.
_Claude Code on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22752: Add SonarCloud PR analysis workflows [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22346:
URL: https://github.com/apache/camel/pull/22346#issuecomment-4158199935
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `build-all`, `build-dependents`, `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23274: Add SonarCloud PR analysis workflows [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet merged PR #22346:
URL: https://github.com/apache/camel/pull/22346
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org