[eSignet-2335]Add Go Sonar Analysis workflow - #388
Conversation
Signed-off-by: Mahesh-Binayak <76687012+Mahesh-Binayak@users.noreply.github.com>
WalkthroughAdds a reusable GitHub Actions workflow for Go SonarQube analysis. The workflow accepts configuration inputs and secrets, runs tests with coverage, validates variables, generates SonarQube properties, and starts the scan. ChangesGo SonarQube Analysis
Estimated code review effort: 3 (Moderate) | ~15–30 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/go-sonar-analysis.yml:
- Around line 42-43: Remove the unused SLACK_WEBHOOK_URL declaration from the
reusable workflow’s secrets configuration, ensuring callers no longer need to
provide this inactive secret while leaving the remaining workflow inputs and
secrets unchanged.
- Around line 45-47: Remove the workflow-level SONAR_TOKEN and ORG_KEY
environment variables in the Sonar workflow. Scope SONAR_TOKEN only to the scan
step, provide ORG_KEY only on the properties step, and remove the redundant
SONAR_TOKEN validation while preserving the existing test and scan behavior.
- Around line 3-4: Update the reusable workflow trigger in on.workflow_call to
declare the least-privileged permissions, including contents: read and only any
additional permissions required by the scanner. In the actions/checkout@v4 step,
pin the action to the approved 40-character commit SHA and set
persist-credentials to false.
- Line 53: Pin every workflow action in the Sonar analysis
workflow—actions/checkout, actions/setup-go, actions/cache, and
SonarSource/sonarqube-scan-action—to the specified immutable commit SHAs,
retaining the corresponding version comments.
- Line 70: Harden the workflow shell commands around the service-directory
change by passing all workflow inputs through step-level env variables and using
quoted shell expansions instead of direct `${{ inputs.* }}` interpolation. Limit
SONAR_TOKEN and ORG_KEY to only the Sonar-required steps, and write Sonar
properties using quoted printf arguments.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0a7a249d-7b8c-48ca-8df1-b2e030d2abbd
📒 Files selected for processing (1)
.github/workflows/go-sonar-analysis.yml
| on: | ||
| workflow_call: |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=.github/workflows/go-sonar-analysis.yml
test -f "$file"
printf '%s\n' '--- workflow ---'
cat -n "$file"
printf '%s\n' '--- workflow references ---'
rg -n '(^|[[:space:]])(permissions:|uses:|run:|with:|secrets:|env:|github\.token|SONAR|GITHUB_TOKEN|curl|wget|checkout)' "$file" || true
printf '%s\n' '--- repository references to workflow inputs/secrets ---'
rg -n 'go-sonar-analysis|SLACK_WEBHOOK_URL|SONAR_TOKEN|SONAR_HOST_URL|persist-credentials' .github README.md 2>/dev/null || trueRepository: mosip/kattu
Length of output: 12804
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- callers of the reusable workflow ---'
rg -n -C 8 'go-sonar-analysis\.yml|go-sonar-analysis' .github/workflows || true
printf '%s\n' '--- workflow-level permissions in repository workflows ---'
rg -n -C 3 '^[[:space:]]*permissions:' .github/workflows || true
printf '%s\n' '--- checkout credential settings and token use ---'
rg -n -C 3 'actions/checkout|persist-credentials|github\.token|GITHUB_TOKEN' .github/workflows .github/actions 2>/dev/null || trueRepository: mosip/kattu
Length of output: 21005
🌐 Web query:
GitHub Actions official documentation reusable workflows permissions caller callee actions checkout persist-credentials default
💡 Result:
In GitHub Actions, reusable workflows and the actions/checkout action handle permissions and credentials as follows: Reusable Workflows and Permissions When using reusable workflows, the permissions for the GITHUB_TOKEN are determined by the caller workflow. If jobs.<job_id>.permissions is not explicitly defined in the calling job, the called reusable workflow inherits the default GITHUB_TOKEN permissions [1][2]. Importantly, a reusable workflow can only downgrade (restrict) the permissions passed from the caller; it cannot elevate them [1][3]. This restriction applies to chains of nested workflows (e.g., A > B > C), where each subsequent workflow must maintain or reduce the permissions of its parent [1][2]. The persist-credentials Option in actions/checkout The persist-credentials input for the actions/checkout action controls whether the credentials used for the checkout are persisted in the local Git configuration [4]. - Default behavior: Historically, persist-credentials defaulted to true [5]. However, security best practices and ongoing updates to GitHub-managed components have pushed toward a default of false to prevent the GITHUB_TOKEN from being unnecessarily exposed to subsequent steps in a job [5][4][6][7]. - When set to true (or when left at a default that persists), the token is stored in the Git config, granting any subsequent steps in the same job implicit access to the token [4][8]. It is generally recommended to set persist-credentials: false unless the job explicitly requires performing authenticated Git operations (such as pushing back to the repository) in later steps [4]. If enabled, the credentials are removed during post-job cleanup [4].
Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
- 2: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/reusing-workflow-configurations.md
- 3: https://docs.github.com/en/enterprise-server@3.13/actions/reference/reusable-workflows-reference
- 4: https://github.com/actions/checkout
- 5: Change the default value of persist-credentials to false actions/checkout#1687
- 6: Harden generated checkout steps to default
persist-credentials: falsegithub/gh-aw#40794 - 7: Always emit
persist-credentials: falsewith actions/checkout github/gh-aw#2641 - 8: Remove
persist-credentialsor change the default tofalseactions/checkout#485
Restrict and remove persisted GITHUB_TOKEN credentials.
This reusable workflow can inherit broader caller permissions than required. actions/checkout@v4 persists credentials unless disabled. A later step can then access the token through Git configuration.
permissions:
contents: read
- uses: actions/checkout@<verified-40-character-SHA> # v4
with:
persist-credentials: falseAdd only permissions required by the scanner.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-sonar-analysis.yml around lines 3 - 4, Update the
reusable workflow trigger in on.workflow_call to declare the least-privileged
permissions, including contents: read and only any additional permissions
required by the scanner. In the actions/checkout@v4 step, pin the action to the
approved 40-character commit SHA and set persist-credentials to false.
Source: Linters/SAST tools
| SLACK_WEBHOOK_URL: | ||
| required: true |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Remove the unused required Slack secret.
SLACK_WEBHOOK_URL has no active consumer. Every caller must still provide it before this reusable workflow can start. Remove this secret declaration.
Proposed fix
- SLACK_WEBHOOK_URL:
- required: trueBased on learnings, workflows may intentionally omit Slack steps because the native Probot application handles action-failure notifications.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| SLACK_WEBHOOK_URL: | |
| required: true |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-sonar-analysis.yml around lines 42 - 43, Remove the
unused SLACK_WEBHOOK_URL declaration from the reusable workflow’s secrets
configuration, ensuring callers no longer need to provide this inactive secret
while leaving the remaining workflow inputs and secrets unchanged.
Source: Learnings
| env: | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | ||
| ORG_KEY: ${{ secrets.ORG_KEY }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/go-sonar-analysis.yml"
printf '%s\n' "--- file ---"
cat -n "$file"
printf '%s\n' "--- workflow references ---"
rg -n -C 3 'SONAR_TOKEN|ORG_KEY|go test|sonar|curl|wget|SLACK_WEBHOOK_URL|permissions:|persist-credentials|uses:' "$file"Repository: mosip/kattu
Length of output: 7966
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
p = Path(".github/workflows/go-sonar-analysis.yml")
lines = p.read_text().splitlines()
workflow_env = {}
in_env = False
for line in lines:
if line == "env:":
in_env = True
continue
if in_env and line and not line.startswith(" "):
break
if in_env:
m = re.match(r"^ ([A-Z0-9_]+):\s*\$\{\{\s*secrets\.([A-Z0-9_]+)\s*\}\}$", line)
if m:
workflow_env[m.group(1)] = m.group(2)
test_start = next(i for i, line in enumerate(lines) if "go test " in line)
property_start = next(i for i, line in enumerate(lines) if "setup sonar properties" in line)
scan_start = next(i for i, line in enumerate(lines) if "SonarQube Scan" in line)
print("workflow_env:", workflow_env)
print("go_test_line:", test_start + 1)
print("workflow_env_inherited_by_test:", bool(workflow_env))
print("properties_uses_ORG_KEY:", any("ORG_KEY" in line for line in lines[property_start:scan_start]))
print("scanner_step_scopes_SONAR_TOKEN:", any("SONAR_TOKEN:" in line for line in lines[scan_start:]))
print("scanner_step_scopes_ORG_KEY:", any("ORG_KEY:" in line for line in lines[scan_start:]))
print("active_test_step_env_block:", any(line.startswith(" env:") for line in lines[test_start - 2:test_start + 1]))
PY
printf '%s\n' "--- reusable-workflow callers ---"
rg -n -C 4 'uses:.*go-sonar-analysis\.yml|go-sonar-analysis' .github || trueRepository: mosip/kattu
Length of output: 1003
Scope Sonar secrets to the required steps.
The workflow-level environment exposes SONAR_TOKEN and ORG_KEY to go test, so test code can read them. Remove the workflow-level environment. Keep SONAR_TOKEN on the scan step, pass ORG_KEY only to the properties step, and remove the redundant SONAR_TOKEN check.
Proposed fix
-env:
- SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- ORG_KEY: ${{ secrets.ORG_KEY }}
-
jobs:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-sonar-analysis.yml around lines 45 - 47, Remove the
workflow-level SONAR_TOKEN and ORG_KEY environment variables in the Sonar
workflow. Scope SONAR_TOKEN only to the scan step, provide ORG_KEY only on the
properties step, and remove the redundant SONAR_TOKEN validation while
preserving the existing test and scan behavior.
| go-sonar-analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/go-sonar-analysis.yml"
printf '%s\n' '--- workflow actions and permissions ---'
rg -n '^\s*(permissions:|[A-Za-z0-9_-]+:)?\s*-?\s*uses:|^\s*uses:|^\s*permissions:' "$file" || true
printf '%s\n' '--- relevant workflow sections ---'
sed -n '1,130p' "$file"
printf '%s\n' '--- repository file status ---'
git ls-files -- "$file"Repository: mosip/kattu
Length of output: 4162
🏁 Script executed:
#!/bin/bash
set -eu
resolve_tag() {
repo="$1"
tag="$2"
echo "--- $repo $tag ---"
git ls-remote "https://github.com/$repo.git" \
"refs/tags/$tag" "refs/tags/$tag^{}"
}
resolve_tag "actions/checkout" "v4"
resolve_tag "actions/setup-go" "v5"
resolve_tag "actions/cache" "v4"
resolve_tag "SonarSource/sonarqube-scan-action" "v8"Repository: mosip/kattu
Length of output: 491
🏁 Script executed:
#!/bin/bash
set -eu
if command -v gh >/dev/null 2>&1; then
gh api repos/actions/checkout/commits/11d5960a326750d5838078e36cf38b85af677262 --jq '.sha'
gh api repos/actions/setup-go/commits/40f1582b2485089dde7abd97c1529aa768e1baff --jq '.sha'
gh api repos/actions/cache/commits/0057852bfaa89a56745cba8c7296529d2fc39830 --jq '.sha'
gh api repos/SonarSource/sonarqube-scan-action/commits/22918119ff8e1ca75a623e15c8296b6ea4fbe28f --jq '.sha'
else
echo "gh is unavailable"
exit 2
fiRepository: mosip/kattu
Length of output: 313
Pin all workflow actions to immutable commit SHAs.
Mutable tags can change code that runs with repository and Sonar credentials. Pin actions/checkout, actions/setup-go, actions/cache, and SonarSource/sonarqube-scan-action to these commits:
Fix
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
- uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8🧰 Tools
🪛 zizmor (1.29.0)
[warning] 53-53: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-sonar-analysis.yml at line 53, Pin every workflow
action in the Sonar analysis workflow—actions/checkout, actions/setup-go,
actions/cache, and SonarSource/sonarqube-scan-action—to the specified immutable
commit SHAs, retaining the corresponding version comments.
Source: Linters/SAST tools
|
|
||
| - name: Run tests with coverage | ||
| run: | | ||
| cd ${{ inputs.SERVICE_LOCATION }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Identify reusable-workflow callers and determine whether these inputs derive
# from event data, dispatch inputs, or static trusted configuration.
rg -n -C 3 \
--glob '*.yml' --glob '*.yaml' \
'go-sonar-analysis\.yml|SERVICE_LOCATION:|SONAR_URL:|SONAR_SOURCES:|SONAR_TESTS:|SONAR_TEST_INCLUSIONS:|SONAR_EXCLUSIONS:' \
.github/workflows || trueRepository: mosip/kattu
Length of output: 16128
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/go-sonar-analysis.yml
printf '%s\n' '--- workflow callers ---'
rg -n -C 8 \
--glob '*.yml' --glob '*.yaml' \
'uses:.*go-sonar-analysis\.yml|go-sonar-analysis\.yml' \
.github || true
printf '%s\n' '--- relevant workflow constructs ---'
rg -n -C 3 \
'^\s*(permissions:|env:|uses:|run:|SONAR_TOKEN|GITHUB_TOKEN|secrets\.|inputs\.|with:)' \
.github/workflows/go-sonar-analysis.ymlRepository: mosip/kattu
Length of output: 6613
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
import subprocess
text = Path(".github/workflows/go-sonar-analysis.yml").read_text()
lines = text.splitlines()
# Extract the two multiline run blocks without executing workflow code.
blocks = []
i = 0
while i < len(lines):
if re.match(r"^\s*run:\s*\|", lines[i]):
base = len(lines[i]) - len(lines[i].lstrip()) + 2
body = []
i += 1
while i < len(lines) and (not lines[i].strip() or len(lines[i]) - len(lines[i].lstrip()) >= base):
body.append(lines[i][base:] if lines[i].strip() else "")
i += 1
blocks.append("\n".join(body))
else:
i += 1
payloads = {
"SERVICE_LOCATION": '.; echo INJECTED; #',
"SONAR_URL": 'https://sonar.example/"; echo INJECTED; #',
"SONAR_SOURCES": 'src"; echo INJECTED; #',
}
for index, block in enumerate(blocks, 1):
print(f"--- run block {index} ---")
for name, payload in payloads.items():
expanded = block.replace("${{ inputs." + name + " }}", payload)
expanded = expanded.replace("${{inputs." + name + "}}", payload)
result = subprocess.run(
["bash", "-n"],
input=expanded,
text=True,
capture_output=True,
)
markers = [
line.strip() for line in expanded.splitlines()
if "echo INJECTED" in line
]
print(f"{name}: bash -n={'accepted' if result.returncode == 0 else 'rejected'}; injected statements={markers}")
print("--- environment-scope evidence ---")
for line_number, line in enumerate(lines, 1):
if 45 <= line_number <= 47 or 68 <= line_number <= 71:
print(f"{line_number}: {line}")
print("--- path-validation probe ---")
validation = r'''case "$SERVICE_LOCATION" in
""|/*|..|../*|*/../*|*/..|*$'\n'*|*$'\r'*) exit 1 ;;
esac'''
for value in ["service", "/tmp/service", "../service", "service/../other", "service/..", "service\nother"]:
script = f'SERVICE_LOCATION={value!r}\n{validation}\nprintf "%s\\n" accepted\n'
result = subprocess.run(["bash"], input=script, text=True, capture_output=True)
print(repr(value), "rejected" if result.returncode else "accepted")
PYRepository: mosip/kattu
Length of output: 1270
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
import subprocess
text = Path(".github/workflows/go-sonar-analysis.yml").read_text()
lines = text.splitlines()
blocks = []
i = 0
while i < len(lines):
if re.match(r"^\s*run:\s*\|", lines[i]):
indent = len(lines[i]) - len(lines[i].lstrip()) + 2
i += 1
body = []
while i < len(lines) and (not lines[i].strip() or len(lines[i]) - len(lines[i].lstrip()) >= indent):
body.append(lines[i][indent:] if lines[i].strip() else "")
i += 1
blocks.append("\n".join(body))
else:
i += 1
for index, block in enumerate(blocks, 1):
print(f"--- run block {index} ---")
for name in ("SERVICE_LOCATION", "SONAR_URL", "SONAR_SOURCES",
"SONAR_TESTS", "SONAR_TEST_INCLUSIONS", "SONAR_EXCLUSIONS"):
payload = "$(echo INJECTED)"
expanded = block.replace("${{ inputs." + name + " }}", payload)
expanded = expanded.replace("${{inputs." + name + "}}", payload)
result = subprocess.run(["bash", "-n"], input=expanded, text=True, capture_output=True)
print(f"{name}: bash -n={'accepted' if result.returncode == 0 else 'rejected'}")
print("--- corrected path-validation probe ---")
validation = r'''case "$SERVICE_LOCATION" in
""|/*|..|../*|*/../*|*/..|*$'\n'*|*$'\r'*) exit 1 ;;
esac'''
values = [
("service", "service"),
("absolute", "/tmp/service"),
("parent-prefix", "../service"),
("embedded-parent", "service/../other"),
("trailing-parent", "service/.."),
("newline", "service\nother"),
]
for label, value in values:
script = "SERVICE_LOCATION=" + subprocess.list2cmdline([value]) + "\n" + validation + '\nprintf "%s\\n" accepted\n'
result = subprocess.run(["bash"], input=script, text=True, capture_output=True)
print(label, "rejected" if result.returncode else "accepted")
PYRepository: mosip/kattu
Length of output: 754
Proposed fix
- name: Run tests with coverage
+ env:
+ SERVICE_LOCATION: ${{ inputs.SERVICE_LOCATION }}
run: |
- cd ${{ inputs.SERVICE_LOCATION }}
+ if [[ -z "$SERVICE_LOCATION" || "$SERVICE_LOCATION" == /* ||
+ "$SERVICE_LOCATION" == .. || "$SERVICE_LOCATION" == ../* ||
+ "$SERVICE_LOCATION" == */../* || "$SERVICE_LOCATION" == */.. ||
+ "$SERVICE_LOCATION" == *$'\n'* || "$SERVICE_LOCATION" == *$'\r'* ]]; then
+ exit 1
+ fi
+ cd -- "$SERVICE_LOCATION"
go test -coverprofile=coverage.out -covermode=atomic ./...When an untrusted caller supplies workflow inputs, direct interpolation into run blocks allows command substitution and shell injection. Pass every input through env and use quoted expansions. Scope SONAR_TOKEN and ORG_KEY only to the steps that require them. Write Sonar properties with quoted printf arguments.
🧰 Tools
🪛 zizmor (1.29.0)
[error] 70-70: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-sonar-analysis.yml at line 70, Harden the workflow
shell commands around the service-directory change by passing all workflow
inputs through step-level env variables and using quoted shell expansions
instead of direct `${{ inputs.* }}` interpolation. Limit SONAR_TOKEN and ORG_KEY
to only the Sonar-required steps, and write Sonar properties using quoted printf
arguments.
Source: Linters/SAST tools
Wire up the sonar_analysis_go_esignet job now that mosip/kattu#388 (go-sonar-analysis.yml) is merged to kattu's develop branch: - uncomment the job, point uses: at @develop - bump GO_VERSION from stale 1.23 to 1.26 (matches build_go_esignet) - exclude sqlc-generated packages (internal/clientmgmt/db, internal/consentmgmt/db) from Sonar's scan alongside the workflow's own vendor/test-file defaults, so generated code doesn't pollute the quality gate with unactionable findings Signed-off-by: Mahesh.Binayak <mahesh.binayak@technoforte.co.in>
Wire up the sonar_analysis_go_esignet job now that mosip/kattu#388 (go-sonar-analysis.yml) is merged to kattu's develop branch: - uncomment the job, point uses: at @develop - bump GO_VERSION from stale 1.23 to 1.26 (matches build_go_esignet) - exclude sqlc-generated packages (internal/clientmgmt/db, internal/consentmgmt/db) from Sonar's scan alongside the workflow's own vendor/test-file defaults, so generated code doesn't pollute the quality gate with unactionable findings Signed-off-by: Mahesh.Binayak <mahesh.binayak@technoforte.co.in>
* Enable Go SonarCloud analysis for esignet-service Wire up the sonar_analysis_go_esignet job now that mosip/kattu#388 (go-sonar-analysis.yml) is merged to kattu's develop branch: - uncomment the job, point uses: at @develop - bump GO_VERSION from stale 1.23 to 1.26 (matches build_go_esignet) - exclude sqlc-generated packages (internal/clientmgmt/db, internal/consentmgmt/db) from Sonar's scan alongside the workflow's own vendor/test-file defaults, so generated code doesn't pollute the quality gate with unactionable findings Signed-off-by: Mahesh.Binayak <mahesh.binayak@technoforte.co.in> * Add keymanager/db exclusion to Sonar analysis Signed-off-by: Mahesh.Binayak <mahesh.binayak@technoforte.co.in> --------- Signed-off-by: Mahesh.Binayak <mahesh.binayak@technoforte.co.in>
2 participants
Summary by CodeRabbit