From fd61d142cb1c5fd850995ca72a03a06fe5b56f22 Mon Sep 17 00:00:00 2001 From: ShaoHua <345265198@qqcom> Date: Fri, 5 Dec 2025 17:01:50 +0800 Subject: [PATCH] fix workflow: remove github dependency + duplicate scan --- .gitea/workflows/sonar-scan.yml | 144 +++++++++++++++++++++++--------- 1 file changed, 106 insertions(+), 38 deletions(-) diff --git a/.gitea/workflows/sonar-scan.yml b/.gitea/workflows/sonar-scan.yml index 6083405..a9a3082 100644 --- a/.gitea/workflows/sonar-scan.yml +++ b/.gitea/workflows/sonar-scan.yml @@ -9,70 +9,138 @@ on: jobs: scan: runs-on: windows-latest - + fail-fast: true env: - # PROXY_HOST: 127.0.0.1 - # PROXY_PORT: 7890 DC_VERSION: 11.0.0 - DC_OUTPUT: ./depcheck + DC_OUTPUT: ${{ github.workspace }}\depcheck + SONAR_HOST_URL: http://127.0.0.1:9000 + PROJECT_KEY: vectordbdemo + # 强制关闭所有代理（关键：避免代理残留导致网络问题） + HTTP_PROXY: "" + HTTPS_PROXY: "" + NO_PROXY: "*" steps: - - name: Checkout Code (Gitea) - uses: actions/checkout@v4 + # 替换 GitHub 的 actions/checkout，改用 Gitea 原生的代码检出（核心修复） + - name: Checkout Code (Gitea Native) + uses: gitea/checkout@v4 # 使用 Gitea 官方 checkout 组件，而非 GitHub 的 + with: + fetch-depth: 0 # 保留完整提交历史，满足 SonarQube 分析 + + - name: 清理系统代理环境变量（确保无残留） + run: | + # 清空系统级代理变量 + [Environment]::SetEnvironmentVariable("HTTP_PROXY", "", "Machine") + [Environment]::SetEnvironmentVariable("HTTPS_PROXY", "", "Machine") + [Environment]::SetEnvironmentVariable("http_proxy", "", "User") + [Environment]::SetEnvironmentVariable("https_proxy", "", "User") + # 验证代理已关闭 + Write-Host "HTTP_PROXY: $env:HTTP_PROXY" + Write-Host "HTTPS_PROXY: $env:HTTPS_PROXY" + shell: pwsh - name: Add Sonar Scanner to PATH run: | - echo "D:\Paths\sonar-scanner-cli\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 + $sonarScannerPath = "D:\Paths\sonar-scanner-cli\bin" + if (-not (Test-Path $sonarScannerPath)) { + Write-Error "Sonar Scanner 路径不存在: $sonarScannerPath" + exit 1 + } + echo "$sonarScannerPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 + shell: pwsh - name: Verify .NET SDK run: | dotnet --list-sdks dotnet --version - - - name: Run OWASP Dependency Check - env: - # HTTP_PROXY: http://127.0.0.1:7890 - # HTTPS_PROXY: http://127.0.0.1:7890 - run: | - New-Item -Path $env:DC_OUTPUT -ItemType Directory -Force - & "D:\Paths\Gitea\dependency-check\bin\dependency-check.bat" ` - --project "VectorDBDemo" ` - --scan "." ` - --format "XML" ` - --out "$env:DC_OUTPUT" + if (-not (dotnet --list-sdks | Select-String -Pattern "8.0.")) { + Write-Error "未找到 .NET 8.0 SDK，请确认 Runner 环境配置" + exit 1 + } shell: pwsh + - name: Run OWASP Dependency Check + run: | + New-Item -Path $env:DC_OUTPUT -ItemType Directory -Force -ErrorAction Stop + $depCheckPath = "D:\Paths\Gitea\dependency-check\bin\dependency-check.bat" + if (-not (Test-Path $depCheckPath)) { + Write-Error "Dependency Check 脚本不存在: $depCheckPath" + exit 1 + } + & $depCheckPath ` + --project "${{ env.PROJECT_KEY }}" ` + --scan "${{ github.workspace }}" ` + --format "XML" ` + --out "$env:DC_OUTPUT" ` + --failOnCVSS 9 + if ($LASTEXITCODE -ne 0) { + Write-Error "OWASP 依赖检查失败" + exit 1 + } + shell: pwsh + + - name: Install dotnet-sonarscanner (本地源/无缓存) + run: | + # 禁用 NuGet 代理，改用本地/内网 NuGet 源（关键：避免访问 nuget.org 超时） + dotnet nuget remove source "nuget.org" -ErrorAction SilentlyContinue + # 替换为内网 NuGet 源（需根据你的环境配置） + dotnet nuget add source "http://your-internal-nuget-server/v3/index.json" -n "InternalNuGet" -p "true" + + if (-not (dotnet tool list --global | Select-String -Pattern "dotnet-sonarscanner")) { + dotnet tool install --global dotnet-sonarscanner --no-cache + } + $sonarToolPath = [Environment]::GetEnvironmentVariable("PATH", "User") + echo "$sonarToolPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 + shell: pwsh - name: Build .NET Project run: | - dotnet restore - dotnet build --configuration Release --no-restore + dotnet restore --verbosity minimal + dotnet build --configuration Release --no-restore --verbosity minimal + if ($LASTEXITCODE -ne 0) { + Write-Error ".NET 项目构建失败" + exit 1 + } + shell: pwsh - name: SonarQube Full Scan run: | - dotnet tool install --global dotnet-sonarscanner --no-cache dotnet sonarscanner begin ` - /k:"vectordbdemo" ` - /d:sonar.host.url="http://127.0.0.1:9000" ` + /k:"${{ env.PROJECT_KEY }}" ` + /d:sonar.host.url="${{ env.SONAR_HOST_URL }}" ` /d:sonar.login="${{ secrets.SONAR_TOKEN }}" ` - /d:sonar.sources="./" ` - /d:sonar.exclusions="**/obj/**,**/bin/**,depcheck/**" ` - /d:sonar.dependencyCheck.xmlReportPath="$env:DC_OUTPUT\dependency-check-report.xml" ` + /d:sonar.sources="${{ github.workspace }}" ` + /d:sonar.exclusions="**/obj/**,**/bin/**,${{ env.DC_OUTPUT }}/**" ` + /d:sonar.dependencyCheck.xmlReportPath="${{ env.DC_OUTPUT }}\dependency-check-report.xml" ` /d:sonar.verbose=true - dotnet build --configuration Release --no-restore - dotnet sonarscanner end ` - /d:sonar.login="${{ secrets.SONAR_TOKEN }}" + dotnet build --configuration Release --no-restore --verbosity minimal + dotnet sonarscanner end `/d:sonar.login="${{ secrets.SONAR_TOKEN }}" + if ($LASTEXITCODE -ne 0) { + Write-Error "SonarQube 扫描失败" + exit 1 + } + shell: pwsh - name: Fetch SonarQube Blocker Issues id: fetch_issues run: | - $projectKey = "vectordbdemo" - $sonarApiUrl = "http://127.0.0.1:9000/api/issues/search?componentKeys=$projectKey&severities=BLOCKER&statuses=OPEN" - $auth = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("${{ secrets.SONAR_TOKEN }}:")) - $response = Invoke-RestMethod -Uri $sonarApiUrl -Headers @{ Authorization = "Basic $auth" } - $blockerCount = $response.total - echo "blocker_issues_count=$blockerCount" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 - if ($blockerCount -gt 0) { - Write-Error "Found $blockerCount Blocker issues in SonarQube" + $sonarApiUrl = "${{ env.SONAR_HOST_URL }}/api/issues/search?componentKeys=${{ env.PROJECT_KEY }}&severities=BLOCKER&statuses=OPEN" + $authToken = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("${{ secrets.SONAR_TOKEN }}:")) + try { + $response = Invoke-RestMethod -Uri $sonarApiUrl ` + -Headers @{ Authorization = "Basic $authToken" } ` + -Method Get ` + -TimeoutSec 30 + $blockerCount = $response.total + echo "blocker_issues_count=$blockerCount" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 + if ($blockerCount -gt 0) { + Write-Error "SonarQube 检测到 $blockerCount 个阻塞级问题，工作流终止" + exit 1 + } else { + Write-Host "✅ SonarQube 无阻塞级问题" + } + } catch { + Write-Error "调用 SonarQube API 失败: $_" exit 1 } + shell: pwsh \ No newline at end of file