chore(ci): add SonarCloud, Snyk SAST, and Codecov — fix blocking lint#23
Conversation
sonar.yml: - Dedicated SonarCloud workflow (push + PR) - Runs pytest with coverage before scan - fetch-depth: 0 for full history analysis snyk.yml: - Dedicated Snyk workflow (PR + weekly schedule) - Two jobs: dependency scan + SAST (code analysis) - Both upload SARIF to GitHub Security tab ci.yml: - Remove inline Sonar/Snyk steps (now in dedicated workflows) - Add Codecov coverage upload (Python 3.11 only) - Add pytest-cov flags and coverage.xml output - Lint is now BLOCKING — removed '|| echo' fallback sonar-project.properties: - Add sonar.python.coverage.reportPaths=coverage.xml
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 49 minutes and 54 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughThis PR refactors the GitHub Actions CI infrastructure by decoupling coverage reporting from the main CI workflow, integrating Codecov for coverage tracking, and moving Snyk and SonarCloud quality/security scans into independent dedicated workflows that are triggered on push/PR events and weekly schedules. ChangesCI Workflow Refactoring and Security Scanning
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/snyk.yml (1)
22-23: ⚡ Quick winAdd
persist-credentials: falseto checkout actions.The checkout action persists git credentials by default. Since this workflow only reads the repository and doesn't need to push changes, disabling credential persistence reduces the risk of credential exposure in subsequent steps or artifacts.
The same change should be applied to the checkout on line 56.
🔐 Proposed fix
- name: Checkout repository uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + persist-credentials: falseApply the same to the second checkout (lines 55-56):
- name: Checkout repository uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/snyk.yml around lines 22 - 23, Update the two checkout steps that use "uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332" (the steps titled "Checkout repository") to include the option persist-credentials: false under their step configuration so git credentials are not persisted; ensure both occurrences (the initial checkout and the second checkout later in the workflow) are updated with the same key/value.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 21-22: The checkout steps using "uses:
actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332" should be hardened by
adding persist-credentials: false to their step configuration; locate each
actions/checkout step (the one in the test job and the other in the lint job)
and add a persist-credentials: false key under that step so Git credentials are
not left in the runner's credential store.
In @.github/workflows/sonar.yml:
- Around line 20-24: The actions/checkout step currently uses fetch-depth: 0 but
leaves the GITHUB_TOKEN persisted; update the checkout configuration (the step
that uses actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332) to set
persist-credentials: false so the token is not written to the checked-out repo
git config during PR runs; keep fetch-depth: 0 as-is and ensure the change is
applied in the same checkout step block in the sonar workflow.
---
Nitpick comments:
In @.github/workflows/snyk.yml:
- Around line 22-23: Update the two checkout steps that use "uses:
actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332" (the steps titled
"Checkout repository") to include the option persist-credentials: false under
their step configuration so git credentials are not persisted; ensure both
occurrences (the initial checkout and the second checkout later in the workflow)
are updated with the same key/value.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b7b69a26-d7a4-4199-ad1a-79b01eb55f76
📒 Files selected for processing (4)
.github/workflows/ci.yml.github/workflows/snyk.yml.github/workflows/sonar.ymlsonar-project.properties
- Run black --target-version py311 on src/ — 5 files reformatted (lint was previously non-blocking so formatting drift went unnoticed) - Add --target-version py311 to black --check in ci.yml - Add persist-credentials: false to all actions/checkout steps in ci.yml (x2), sonar.yml (x1), snyk.yml (x2) Addresses CodeRabbit zizmor artipacked warning
crypto.py: remove unused json import trust_boundary.py: remove unused defaultdict and ield imports Pre-existing drift — previously hidden by non-blocking lint.
2 participants
What
Brings qwed-a2a's CI/CD tooling to parity with qwed-verification.
Changes
New:
.github/workflows/sonar.ymlfetch-depth: 0for accurate blame/history analysisNew:
.github/workflows/snyk.ymlUpdated:
.github/workflows/ci.yml|| echo "failed"fallbackUpdated:
sonar-project.propertiessonar.python.coverage.reportPaths=coverage.xmlWhy
PRs (including contributor PRs like #21) were running without Sonar quality gate, Snyk SAST, or Codecov coverage tracking. Lint was also non-blocking, meaning formatting violations were silently ignored.
Summary by CodeRabbit
Release Notes