Boosting Code Quality: SonarQube on a Self-Hosted Windows Runner with GitHub Actions

In the sivbg-project, maintaining high code quality is paramount. To reinforce our commitment to robust and maintainable code, we've integrated SonarQube into our continuous integration pipeline. This post details how we set up a SonarQube analysis job on a self-hosted Windows runner using GitHub Actions, leveraging the sonar-scanner-npm and enforcing quality gates.

The Need for Self-Hosted Runners

While GitHub-hosted runners offer great convenience, specific project requirements sometimes necessitate self-hosted environments. For the sivbg-project, the decision to use a Windows self-hosted runner was driven by factors such as specific build dependencies, network configurations, or the need for a persistent environment. This allows us to have greater control over the execution environment for our CI/CD jobs, ensuring compatibility and performance tailored to our needs.

Integrating SonarQube into CI

SonarQube is a powerful tool for static code analysis, identifying bugs, vulnerabilities, and code smells. Integrating it into a GitHub Actions workflow means every push or pull request can automatically trigger a code quality scan. This proactive approach helps catch issues early, preventing them from propagating into the codebase.

The Workflow: sonar-scanner-npm and Quality Gates

Our SonarQube integration utilizes the sonar-scanner-npm tool, which is ideal for JavaScript and Node.js projects like ours. This scanner can be easily invoked within a GitHub Actions job to analyze the project's source code and send the results to our SonarQube server. A critical component of this setup is the qualitygate.wait parameter. By enabling this, our CI workflow will wait for the SonarQube quality gate status. If the code fails to meet the defined quality standards (e.g., too many new bugs, critical vulnerabilities), the job will fail, preventing the problematic code from being merged.

Here's a simplified example of how this might look in a GitHub Actions workflow YAML:

name: SonarQube Analysis

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  sonar_scan:
    runs-on: self-hosted # Specifies our self-hosted Windows runner

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0 # Required for SonarQube SCM integration

    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '18'

    - name: Install dependencies
      run: npm install

    - name: SonarQube Scan
      run: npm run sonar-scanner
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        SONAR_HOST_URL: "https://sonarcloud.io" # Replace with your SonarQube host

And in your package.json (or similar script definition):

{
  "name": "my-project",
  "version": "1.0.0",
  "scripts": {
    "sonar-scanner": "sonar-scanner -Dsonar.projectKey=your-project-key -Dsonar.sources=. -Dsonar.tests=./tests -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info -Dsonar.qualitygate.wait=true"
  },
  "devDependencies": {
    "sonar-scanner": "^3.0.1"
  }
}

The Outcome

This setup provides immediate feedback on code quality for every change, directly within our GitHub Pull Request interface. By enforcing the quality gate, we ensure that only code meeting our predefined standards can be merged, significantly reducing technical debt and improving the overall health of the sivbg-project codebase. It streamlines our development process by automating a critical aspect of code review.

The Lesson

Integrating automated code quality checks with a mandatory quality gate into your CI/CD pipeline is a powerful way to enforce coding standards and prevent issues from accumulating. Utilize self-hosted runners when your project demands specific environments, and leverage tools like sonar-scanner-npm and qualitygate.wait to create a robust, secure, and quality-driven development workflow. Always remember to store sensitive credentials like SONAR_TOKEN securely as GitHub Secrets.

Generated with Gitvlg.com