Skip to content

ci: bump the github_actions group across 1 directory with 3 updates #60

ci: bump the github_actions group across 1 directory with 3 updates

ci: bump the github_actions group across 1 directory with 3 updates #60

Workflow file for this run

name: Build & SonarQube
on:
push:
branches: [ main, develop ]
paths-ignore:
- '*.md'
- '**/*.md'
pull_request:
types: [ opened, synchronize, reopened ]
paths-ignore:
- '*.md'
- '**/*.md'
permissions:
contents: read
pull-requests: read
jobs:
build:
name: GCC 15 • Build • Test • Coverage • Main-only Sonar
runs-on: ubuntu-latest
# Use a container that already has GCC 15
container:
image: gcc:15
env:
# Opt in now so CI proves the workflow is compatible before GitHub forces
# JavaScript actions onto Node 24 in June 2026.
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
# Must match your sonar-project.properties:
# sonar.cfamily.compile-commands=build/bw-output/compile_commands.json
BUILD_WRAPPER_OUT_DIR: build/bw-output
CTEST_OUTPUT_ON_FAILURE: "1"
steps:
- name: Install build prerequisites
run: |
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
cmake ninja-build gcovr lcov valgrind git ca-certificates python3
update-ca-certificates
- name: Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Toolchain sanity check
run: |
gcc --version
g++ --version
gcov --version || true
ninja --version
cmake --version
- name: Check main-branch Sonar credentials
id: sonar
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
run: |
if [ -n "${SONAR_TOKEN}" ]; then
echo "enabled=true" >> "${GITHUB_OUTPUT}"
else
echo "enabled=false" >> "${GITHUB_OUTPUT}"
fi
- name: Install Sonar prerequisites
if: steps.sonar.outputs.enabled == 'true'
run: |
DEBIAN_FRONTEND=noninteractive apt-get install -y unzip default-jre-headless
- name: Install Sonar Build Wrapper
if: steps.sonar.outputs.enabled == 'true'
uses: SonarSource/sonarqube-scan-action/install-build-wrapper@22918119ff8e1ca75a623e15c8296b6ea4fbe28f
# Equivalent to: rm -rf build && cmake -S . -B build
- name: Configure (CMake • Debug • Ninja • GCC 15)
env:
CXX: g++
run: |
sonar_enabled=OFF
if [ "${{ steps.sonar.outputs.enabled }}" = "true" ]; then
sonar_enabled=ON
fi
rm -rf build "${BUILD_WRAPPER_OUT_DIR}"
cmake -S . -B build -G Ninja \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-DENABLE_COVERAGE=ON \
-DENABLE_SONAR="${sonar_enabled}" \
-DCMAKE_CXX_COMPILER="${CXX}"
# Equivalent to: cmake --build build -j
- name: Build (unwrapped compile)
run: |
cmake --build build -j"$(nproc)"
# Equivalent to: cmake --build build --target sonar_bw -j
- name: Build (CMake target sonar_bw wrapped by build-wrapper)
if: steps.sonar.outputs.enabled == 'true'
run: |
cmake --build build --target sonar_bw -j"$(nproc)"
env:
# Ensure the install step put it on PATH; the CMake target will also auto-detect.
BUILD_WRAPPER_OUT_DIR: ${{ env.BUILD_WRAPPER_OUT_DIR }}
# Equivalent to: ctest --test-dir build --output-on-failure
- name: Test
run: |
ctest --test-dir build --output-on-failure
- name: Leak Check
run: |
cmake --build build --target leak_check
# Equivalent to: cmake --build build --target coverage
- name: Coverage
run: |
cmake --build build --target coverage
# Equivalent to: sonar-scanner
- name: SonarQube Scan
if: steps.sonar.outputs.enabled == 'true'
uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
SONAR_SCANNER_SKIP_JRE_PROVISIONING: "true"
with:
args: >
--define sonar.organization=stephenlclarke
--define sonar.projectKey=stephenlclarke_ScopeTimer
--define sonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
--define sonar.coverageReportPaths=build/sonarqube-coverage.xml