Skip to content

Commit

Permalink
SQSCANGHA-42 Update scanner cli to v11.0
Browse files Browse the repository at this point in the history
  • Loading branch information
@istvan-bodo-sonarsource
istvan-bodo-sonarsource committed Aug 13, 2024
1 parent 8c8682d commit 0c0f395
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 8 deletions.
12 changes: 6 additions & 6 deletions .github/workflows/qa.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
- name: Run action with args
uses: ./
with:
args: -Dsonar.someArg=aValue -Dsonar.scanner.dumpToFile=./output.properties
args: -Dsonar.someArg=aValue -Dsonar.scanner.internal.dumpToFile=./output.properties
env:
SONAR_HOST_URL: http://not_actually_used
- name: Assert
Expand All @@ -37,7 +37,7 @@ jobs:
- name: Run action with projectBaseDir
uses: ./
with:
args: -Dsonar.scanner.dumpToFile=./output.properties
args: -Dsonar.scanner.internal.dumpToFile=./output.properties
projectBaseDir: ./baseDir
env:
SONAR_HOST_URL: http://not_actually_used
Expand All @@ -60,7 +60,7 @@ jobs:
SONAR_HOST_URL: http://not_actually_used
with:
projectBaseDir: ./test/gradle-project
args: -Dsonar.scanner.dumpToFile=./output.properties
args: -Dsonar.scanner.internal.dumpToFile=./output.properties
- name: Assert
run: |
./test/assertFileExists ./output.properties
Expand All @@ -80,7 +80,7 @@ jobs:
SONAR_HOST_URL: http://not_actually_used
with:
projectBaseDir: ./test/gradle-project
args: -Dsonar.scanner.dumpToFile=./output.properties
args: -Dsonar.scanner.internal.dumpToFile=./output.properties
- name: Assert
run: |
./test/assertFileExists ./output.properties
Expand All @@ -100,7 +100,7 @@ jobs:
SONAR_HOST_URL: http://not_actually_used
with:
projectBaseDir: ./test/maven-project
args: -Dsonar.scanner.dumpToFile=./output.properties
args: -Dsonar.scanner.internal.dumpToFile=./output.properties
- name: Assert
run: |
./test/assertFileExists ./output.properties
Expand Down Expand Up @@ -146,7 +146,7 @@ jobs:
- name: Run action with debug mode
uses: ./
with:
args: -Dsonar.scanner.dumpToFile=./output.properties
args: -Dsonar.scanner.internal.dumpToFile=./output.properties
env:
RUNNER_DEBUG: 1
SONAR_HOST_URL: http://not_actually_used
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM sonarsource/sonar-scanner-cli:10.0
FROM sonarsource/sonar-scanner-cli:11.0

LABEL version="2.1.0" \
LABEL version="3.0.0" \
repository="https://github.com/sonarsource/sonarqube-scan-action" \
homepage="https://github.com/sonarsource/sonarqube-scan-action" \
maintainer="SonarSource" \
Expand Down

6 comments on commit 0c0f395

@BPouw
Copy link

@BPouw BPouw commented on 0c0f395 Aug 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey Istvan,

Pretty sure this release just killed my pipeline, not sure if this is intended but i think you did not include the keytool in the docker image:

/entrypoint.sh: line 15: keytool: command not found

@jwhy89
Copy link

@jwhy89 jwhy89 commented on 0c0f395 Aug 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey Istvan,

Pretty sure this release just killed my pipeline, not sure if this is intended but i think you did not include the keytool in the docker image:

/entrypoint.sh: line 15: keytool: command not found

Same here!

@carboleda
Copy link

@carboleda carboleda commented on 0c0f395 Aug 14, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey Istvan,

After the update I'm also experiencing issues with the server certificate validation, I also tried using the SONAR_ROOT_CERT but them I received the same error reported by @BPouw. The workaround I found was specifying the previous version sonarSource/[email protected].

Below I attached some relevant information:

  • Action configuration: 
    ...
- name: SonarQube Scan
      uses: sonarsource/sonarqube-scan-action@master
      env:
        SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
        SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST }}
...
  • Stack trace error:
23:06:13.506 INFO  Scanner configuration file: /opt/sonar-scanner/conf/sonar-scanner.properties
23:06:13.510 INFO  Project root configuration file: /github/workspace/sonar-project.properties
23:06:13.535 INFO  SonarScanner CLI 6.1.0.4477
23:06:13.537 INFO  Java 17.0.11 Eclipse Adoptium (64-bit)
23:06:13.538 INFO  Linux 5.15.0-1062-gcp amd64
23:06:13.579 INFO  User cache: /opt/sonar-scanner/.sonar/cache
23:06:14.805 INFO  EXECUTION FAILURE
23:06:14.806 INFO  Total time: 1.304s
23:06:14.807 ERROR Error during SonarScanner CLI execution
java.lang.IllegalStateException: Failed to get server version
	at org.sonarsource.scanner.lib.ScannerEngineBootstrapper.getServerVersion(ScannerEngineBootstrapper.java:148)
	at org.sonarsource.scanner.lib.ScannerEngineBootstrapper.bootstrap(ScannerEngineBootstrapper.java:112)
	at org.sonarsource.scanner.cli.Main.analyze(Main.java:75)
	at org.sonarsource.scanner.cli.Main.main(Main.java:63)
Caused by: java.lang.IllegalStateException: Call to URL [***api/v2/analysis/version] failed
	at org.sonarsource.scanner.lib.internal.http.ServerConnection.callUrl(ServerConnection.java:178)
	at org.sonarsource.scanner.lib.internal.http.ServerConnection.callApi(ServerConnection.java:145)
	at org.sonarsource.scanner.lib.internal.http.ServerConnection.callRestApi(ServerConnection.java:123)
	at org.sonarsource.scanner.lib.ScannerEngineBootstrapper.getServerVersion(ScannerEngineBootstrapper.java:143)
	... 3 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: None of the TrustManagers trust this certificate chain
	at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
	at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.kt:379)
	at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.kt:337)
	at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:209)
	at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226)
	at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106)
	at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74)
	at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255)
	at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.logging.HttpLoggingInterceptor.intercept(HttpLoggingInterceptor.kt:221)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201)
	at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154)
	at org.sonarsource.scanner.lib.internal.http.ServerConnection.callUrl(ServerConnection.java:176)
	... 6 common frames omitted
Caused by: java.security.cert.CertificateException: None of the TrustManagers trust this certificate chain
	at nl.altindag.ssl.trustmanager.CombinableX509TrustManager.checkTrusted(CombinableX509TrustManager.java:61)
	at nl.altindag.ssl.trustmanager.CompositeX509ExtendedTrustManager.checkServerTrusted(CompositeX509ExtendedTrustManager.java:86)

@istvan-bodo-sonarsource
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello,

Thank you for your feedback, and I apologize for the inconvenience.

We are currently checking the logs and working on the solution; until that is released, could you please pin the version and use the v2.3.0 explicitly?

@Torbjorn-Svensson
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason for the missing keytool is that you no longer include the JRE/JDK from the docker distribution, but instead bundle your own stripped down version with the sonar-scanner-cli.
For some reason, it was decided to remove the jre/bin/keytool from the linux-x64 delivery.

To avoid this problem in the future, I suggest that you add some kind of verification to the sonarqube-scan-action that the required commands are available in the docker image.
IIRC, this is the 2nd time in the past few months that the self-signed certificates/CA handling in the action/docker image breaks.

@istvan-bodo-sonarsource
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason for the missing keytool is that you no longer include the JRE/JDK from the docker distribution, but instead bundle your own stripped down version with the sonar-scanner-cli. For some reason, it was decided to remove the jre/bin/keytool from the linux-x64 delivery.

To avoid this problem in the future, I suggest that you add some kind of verification to the sonarqube-scan-action that the required commands are available in the docker image. IIRC, this is the 2nd time in the past few months that the self-signed certificates/CA handling in the action/docker image breaks.

Thank you for your feedback and suggestions @Torbjorn-Svensson.

We reverted the change that caused the breakdown. Also, as I mentioned above, we suggest referencing the commit hash or version tag instead of the branch for the action:

SonarSource/sonarqube-scan-action@2af7c4bea3abd8c236b5edb80998f31374896f09

SonarSource/[email protected]

Please sign in to comment.