VectorDBDemo/.gitea/workflows/sonar-scan.yml

name: SonarQube Code Quality Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  scan:
    runs-on: windows-latest
    fail-fast: true
    env:
      DC_VERSION: 11.0.0
      DC_OUTPUT: ${{ github.workspace }}\depcheck
      SONAR_HOST_URL: http://127.0.0.1:9000
      PROJECT_KEY: vectordbdemo
      # 强制关闭所有代理（关键：避免代理残留导致网络问题）
      HTTP_PROXY: ""
      HTTPS_PROXY: ""
      NO_PROXY: "*"

    steps:
      # 替换 GitHub 的 actions/checkout，改用 Gitea 原生的代码检出（核心修复）
      - name: Checkout Code (Gitea Native)
        uses: gitea/checkout@v4  # 使用 Gitea 官方 checkout 组件，而非 GitHub 的
        with:
          fetch-depth: 0  # 保留完整提交历史，满足 SonarQube 分析

      - name: 清理系统代理环境变量（确保无残留）
        run: |
          # 清空系统级代理变量
          [Environment]::SetEnvironmentVariable("HTTP_PROXY", "", "Machine")
          [Environment]::SetEnvironmentVariable("HTTPS_PROXY", "", "Machine")
          [Environment]::SetEnvironmentVariable("http_proxy", "", "User")
          [Environment]::SetEnvironmentVariable("https_proxy", "", "User")
          # 验证代理已关闭
          Write-Host "HTTP_PROXY: $env:HTTP_PROXY"
          Write-Host "HTTPS_PROXY: $env:HTTPS_PROXY"
        shell: pwsh

      - name: Add Sonar Scanner to PATH
        run: |
          $sonarScannerPath = "D:\Paths\sonar-scanner-cli\bin"
          if (-not (Test-Path $sonarScannerPath)) {
            Write-Error "Sonar Scanner 路径不存在: $sonarScannerPath"
            exit 1
          }
          echo "$sonarScannerPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8
        shell: pwsh

      - name: Verify .NET SDK
        run: |
          dotnet --list-sdks
          dotnet --version
          if (-not (dotnet --list-sdks | Select-String -Pattern "8.0.")) {
            Write-Error "未找到 .NET 8.0 SDK，请确认 Runner 环境配置"
            exit 1
          }
        shell: pwsh

      - name: Run OWASP Dependency Check
        run: |
          New-Item -Path $env:DC_OUTPUT -ItemType Directory -Force -ErrorAction Stop
          $depCheckPath = "D:\Paths\Gitea\dependency-check\bin\dependency-check.bat"
          if (-not (Test-Path $depCheckPath)) {
            Write-Error "Dependency Check 脚本不存在: $depCheckPath"
            exit 1
          }
          & $depCheckPath `
            --project "${{ env.PROJECT_KEY }}" `
            --scan "${{ github.workspace }}" `
            --format "XML" `
            --out "$env:DC_OUTPUT" `
            --failOnCVSS 9
          if ($LASTEXITCODE -ne 0) {
            Write-Error "OWASP 依赖检查失败"
            exit 1
          }
        shell: pwsh

      - name: Install dotnet-sonarscanner (本地源/无缓存)
        run: |
          # 禁用 NuGet 代理，改用本地/内网 NuGet 源（关键：避免访问 nuget.org 超时）
          dotnet nuget remove source "nuget.org" -ErrorAction SilentlyContinue
          # 替换为内网 NuGet 源（需根据你的环境配置）
          dotnet nuget add source "http://your-internal-nuget-server/v3/index.json" -n "InternalNuGet" -p "true"
          
          if (-not (dotnet tool list --global | Select-String -Pattern "dotnet-sonarscanner")) {
            dotnet tool install --global dotnet-sonarscanner --no-cache
          }
          $sonarToolPath = [Environment]::GetEnvironmentVariable("PATH", "User")
          echo "$sonarToolPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8
        shell: pwsh

      - name: Build .NET Project
        run: |
          dotnet restore --verbosity minimal
          dotnet build --configuration Release --no-restore --verbosity minimal
          if ($LASTEXITCODE -ne 0) {
            Write-Error ".NET 项目构建失败"
            exit 1
          }
        shell: pwsh

      - name: SonarQube Full Scan
        run: |
          dotnet sonarscanner begin `
            /k:"${{ env.PROJECT_KEY }}" `
            /d:sonar.host.url="${{ env.SONAR_HOST_URL }}" `
            /d:sonar.login="${{ secrets.SONAR_TOKEN }}" `
            /d:sonar.sources="${{ github.workspace }}" `
            /d:sonar.exclusions="**/obj/**,**/bin/**,${{ env.DC_OUTPUT }}/**" `
            /d:sonar.dependencyCheck.xmlReportPath="${{ env.DC_OUTPUT }}\dependency-check-report.xml" `
            /d:sonar.verbose=true
          dotnet build --configuration Release --no-restore --verbosity minimal
          dotnet sonarscanner end `/d:sonar.login="${{ secrets.SONAR_TOKEN }}"
          if ($LASTEXITCODE -ne 0) {
            Write-Error "SonarQube 扫描失败"
            exit 1
          }
        shell: pwsh

      - name: Fetch SonarQube Blocker Issues
        id: fetch_issues
        run: |
          $sonarApiUrl = "${{ env.SONAR_HOST_URL }}/api/issues/search?componentKeys=${{ env.PROJECT_KEY }}&severities=BLOCKER&statuses=OPEN"
          $authToken = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("${{ secrets.SONAR_TOKEN }}:"))
          try {
            $response = Invoke-RestMethod -Uri $sonarApiUrl `
              -Headers @{ Authorization = "Basic $authToken" } `
              -Method Get `
              -TimeoutSec 30
            $blockerCount = $response.total
            echo "blocker_issues_count=$blockerCount" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8
            if ($blockerCount -gt 0) {
              Write-Error "SonarQube 检测到 $blockerCount 个阻塞级问题，工作流终止"
              exit 1
            } else {
              Write-Host "✅ SonarQube 无阻塞级问题"
            }
          } catch {
            Write-Error "调用 SonarQube API 失败: $_"
            exit 1
          }
        shell: pwsh