Question

我有一个gitlab-ci集成，需要进行声纳分析，如果质量门通过，则构建一个泊坞窗图像。

这可以使用gitlab-ci吗？

Answer 1

要为失败的质量门而中断CI构建，

1。在/report-task.txt中搜索CE任务URL（ceTaskUrl）和CE的值任务ID（ceTaskId）

2.Call / api / ce / task？id = XXX，其中XXX是从步骤1中检索到的CE任务ID 例如：-https：/// api / ce / task？id =您的ceTaskId

3。等待一段时间，直到步骤2中的状态为“成功”，“已取消”或“失败”

4。如果失败，则中断构建（此处失败，无法生成声纳报告）

5。如果成功，则使用/ api / ce / task返回的JSON中的analysisId？ id = XXX（step2）并立即调用/ api / qualitygates / project_status？analysisId = YYY来检查质量门的状态。例如：-https：/// api / qualitygates / project_status？analysisId =您的 analysisId

6。步骤5给出了严重，严重和轻微错误阈值限制的状态

7。基于限制，中断构建。

8.使用脚本时遵循适当的缩进

build:
  stage: build
  before_script:
   - yum -y install epel-release
   - yum -y install jq
   - yum install -y coreutils
  script:
    - mvn sonar:sonar -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.login=$SONAR_LOGIN_TOKEN -Dsonar.working.directory=../target/.sonar
    - export url=$(cat ../target/.sonar/report-task.txt | grep ceTaskUrl | cut -c11- ) #URL where report gets stored
    - sleep 15s #Wait time for the report
    - curl -k -u "$SONAR_LOGIN_TOKEN":"" $url -o analysis.txt
    - export status=$(cat analysis.txt | jq -r '.task.status') #Status as SUCCESS, CANCELED or FAILED
    - export analysisId=$(cat analysis.txt | jq -r '.task.analysisId') #Get the analysis Id
    - |
      if [ "$status" == "SUCCESS" ];then 
        echo -e "SONAR ANALYSIS SUCCESSFUL...ANALYSING RESULTS";
        curl -k -u "$SONAR_LOGIN_TOKEN":"" https://yourSonarURI/api/qualitygates/project_status?analysisId=$analysisId -o result.txt; #Analysis result like critical, major and minor issues
        export result=$(cat result.txt | jq -r '.projectStatus.status');

        if [ "$result" == "ERROR" ];then
          echo -e "91mSONAR RESULTS FAILED";
          echo "$(cat result.txt | jq -r '.projectStatus.conditions')"; #prints the critical, major and minor violations
          exit 1 #breaks the build for violations
        else
          echo -e "SONAR RESULTS SUCCESSFUL";
          echo "$(cat result.txt | jq -r '.projectStatus.conditions')";
          exit 0 
        fi
    else 
        echo -e "\e[91mSONAR ANALYSIS FAILED\e[0m";
        exit 1 #breaks the build for failure in Step2
     fi

Answer 2

从 SonarQube 8.1 开始，这可以通过构建命令中的参数实现。请参阅 https://docs.sonarqube.org/latest/analysis/gitlab-integration/，“当质量门失败时管道作业失败”：

<块引用>

当质量门失败时流水线作业失败为了在 SonarQube 端失败时质量门在 GitLab 端失败，扫描仪需要等待 SonarQube 质量门状态。要启用此功能，请在 sonar.qualitygate.wait=true 文件中设置 .gitlab-ci.yml 参数。您可以将 sonar.qualitygate.timeout 属性设置为扫描程序应等待处理报告的时间量（以秒为单位）。默认值为 300 秒。

示例：

mvn verify sonar:sonar -Dsonar.qualitygate.wait=true

Answer 3

你应该试试Sonar Build Breaker plugin。它允许返回非零，这将破坏Gitlab CI Runner的构建，而不是执行下一步（构建Docker镜像）。

在项目的根目录中创建.gitlab-ci.yml文件：

stages:
  - sonarqube
  - docker_build
image: maven:3-jdk-8
sonarqube:
  stage: sonarqube
  script:
    - # sonarqube running command (plugin installed), mvn blabla
docker_build
   stage: docker_build
   script:
     - docker build .

只有当sonarqube通过质量门时，对Gitlab的提交才会运行sonarqube阶段并继续docker_build。

Answer 4

感谢Sahit的回答。看来解决方案是针对Linux的。我希望它与Windows兼容。

- $url = (findstr "ceTaskUrl" "<report-task.txt location>").Substring(10) 
- sleep 10 #Need some buffer time to get the report updated from sonarqube analyzer
- $response = &"<Curl exe location>" -u <SonarAdminUserName>:<Password> $url #using curl to login to sonarqube to check analysis ran properly or not. Using sonar admin credentials/token
- $sonardata = $response | ConvertFrom-Json #converting returned data to json 
- $sonarBuildStatus=$sonardata.task.status
- |
      if ("$sonarBuildStatus" -eq "SUCCESS"){ 
          echo "SONARQUBE ANALYSIS IS SUCCESSFUL"
          $sonarAnalysisId= $sonardata.task.analysisId
          $projurl = (findstr "serverUrl" "<report-task.txt location>").Substring(10)
          $projNewUrl = $projurl+"/api/qualitygates/project_status?analysisId="+$sonarAnalysisId
          $projresponse = &"<Curl exe location>" -u <SonarAdminUserName>:<Password> $projNewUrl
          $sonarprojdata = $projresponse | ConvertFrom-Json
          $sonarProjStatus=$sonarprojdata.projectStatus.status
          if ("$sonarProjStatus" -eq "ERROR"){ #Checks if the project has meet all the quality gates specified
              echo  "SONARQUBE QUALITY GATES FAILED FOR $CI_PROJECT_NAME"
              echo $sonarprojdata.projectStatus.conditions
              exit 1 #breaks the build for violations
          }
          else{
              echo "SONARQUBE QUALITY GATES SUCCESSFUL FOR $CI_PROJECT_NAME"
              echo $sonarprojdata.projectStatus.conditions
              exit 0
          }
          
      }
      else{
          echo "SONARQUBE ANALYSIS FAILED"
          exit 1 #breaks the build for violations
      }

请参阅链接以获取更多信息https://www.codeproject.com/Tips/5165909/Gated-Check-in-in-Git-repository

Answer 5

有一个用Go编写的simple standalone tool，可以与SQ 5。*-8.2一起使用，以简单地检查特定项目的SQ QG。它需要SQ实例的URL，项目密钥以及令牌或登录名和密码才能运行。

它还有另外一个技巧，可以等待项目中是否有待处理的任务。现在，apriorit/go-check-sonar还有一个轻量级的Docker image。像这样使用：

$ docker run --rm -it apriorit/go-check-sonar -project=PROJ -server=http://sonar.dev.local -token=dead**beef
Running SonarQube Quality Gate checker!
Checking if any tasks are running for the provided project...

Waiting for pending tasks to finish...

1 pending tasks remaining for PROJ component...
1 pending tasks remaining for PROJ component...
1 pending tasks remaining for PROJ component...
0 pending tasks remaining for PROJ component...
All tasks on project PROJ are finished!

Checking Quality Gate status of the project...

==============================================
Project Status: OK
==============================================

如何将Sonar Quality Gates与Gitlab-CI集成

5 个答案:

8.使用脚本时遵循适当的缩进