Skip to content

ci(sonarqube): pin the CI reusables to the scan without PR analysis #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BryanFRD merged 1 commit into from
Sep 18, 2026
Merged

ci(sonarqube): pin the CI reusables to the scan without PR analysis #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/workflows/reusable-ci-astro.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,8 +211,7 @@ jobs:
permissions:
contents: read
packages: read
Comment on lines 212 to 213

@ferrfleet ferrfleet Bot Sep 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: packages: read is surplus here for the same reason pull-requests: write was. The scan at efe7f97 only checks out, downloads artifacts and runs sonar-scanner; nothing reads GitHub Packages, and the callee declares contents: read alone.

Suggested change
contents: read
packages: read
contents: read

pull-requests: write
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@2883414f68b4029d28d8700d2a51d070f7528111 # main
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@efe7f9708acb0ab525649badcade6e3a6ef678b5 # main
with:
runner: ${{ inputs.runner }}
working-directory: ${{ inputs.sonar-base-dir || inputs.working-directory }}
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/reusable-ci-go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,8 +273,7 @@ jobs:
needs: test
permissions:
contents: read
pull-requests: write
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@2883414f68b4029d28d8700d2a51d070f7528111 # main
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@efe7f9708acb0ab525649badcade6e3a6ef678b5 # main
with:
runner: ${{ inputs.runner }}
working-directory: ${{ inputs.sonar-base-dir || inputs.working-directory }}
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/reusable-ci-node.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,8 +291,7 @@ jobs:
permissions:
contents: read
packages: read
Comment on lines 292 to 293

@ferrfleet ferrfleet Bot Sep 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: same as in the Astro reusable, packages: read is unused by the scan job (the install happens in test, not in the called workflow).

Suggested change
contents: read
packages: read
contents: read

pull-requests: write
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@2883414f68b4029d28d8700d2a51d070f7528111 # main
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@efe7f9708acb0ab525649badcade6e3a6ef678b5 # main
with:
runner: ${{ inputs.runner }}
working-directory: ${{ inputs.sonar-base-dir || inputs.working-directory }}
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/reusable-ci-rust.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -626,8 +626,7 @@ jobs:
needs: coverage
permissions:
contents: read
pull-requests: write
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@2883414f68b4029d28d8700d2a51d070f7528111 # main
uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@efe7f9708acb0ab525649badcade6e3a6ef678b5 # main
with:
runner: ${{ inputs.runner }}
working-directory: ${{ inputs.working-directory }}
Expand Down
Loading