bstein/soteria
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: collect sonar and supply-chain evidence for gate metrics

Browse Source
This commit is contained in:
Brad Stein 2026-04-19 14:12:58 -03:00
parent 30b3aee931
commit 420c6a90ad
1 changed files with 160 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

246
Jenkinsfile vendored
View File

@ -70,6 +70,8 @@ spec:
environment { environment {
SUITE_NAME = 'soteria' SUITE_NAME = 'soteria'
PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091' PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091'
QUALITY_GATE_SONARQUBE_REPORT = 'build/sonarqube-quality-gate.json'
QUALITY_GATE_IRONBANK_REPORT = 'build/ironbank-compliance.json'
} }
options { options {
disableConcurrentBuilds() disableConcurrentBuilds()
@ -91,9 +93,6 @@ spec:
} }
} }
stage('Prep toolchain') { stage('Prep toolchain') {
when {
expression { return params.PUBLISH_IMAGES }
}
steps { steps {
container('builder') { container('builder') {
sh ''' sh '''
@ -108,97 +107,170 @@ spec:
stage('Run quality gate') { stage('Run quality gate') {
steps { steps {
container('tester') { container('tester') {
retry(2) { sh '''
sh ''' set -eu
set -eu apt-get update >/dev/null
apt-get update >/dev/null apt-get install -y --no-install-recommends jq python3 >/dev/null
apt-get install -y --no-install-recommends jq python3 ripgrep >/dev/null mkdir -p build
mkdir -p build python3 - <<'PY'
set +e import base64
bash scripts/check.sh import json
gate_rc=$? import os
set -e import urllib.parse
if [ ! -f build/go-test.json ]; then import urllib.request
: > build/go-test.json from pathlib import Path
fi
tests_total="$(jq -s '[.[] | select(.Test != null and (.Action=="pass" or .Action=="fail" or .Action=="skip"))] | length' build/go-test.json 2>/dev/null || echo 0)" host = os.getenv('SONARQUBE_HOST_URL', '').strip().rstrip('/')
tests_failed="$(jq -s '[.[] | select(.Test != null and .Action=="fail")] | length' build/go-test.json 2>/dev/null || echo 0)" project_key = os.getenv('SONARQUBE_PROJECT_KEY', '').strip()
tests_skipped="$(jq -s '[.[] | select(.Test != null and .Action=="skip")] | length' build/go-test.json 2>/dev/null || echo 0)" token = os.getenv('SONARQUBE_TOKEN', '').strip()
tests_errors="$(jq -s '[.[] | select(.Test == null and .Action=="fail")] | length' build/go-test.json 2>/dev/null || echo 0)" sonar_report = os.getenv('QUALITY_GATE_SONARQUBE_REPORT', 'build/sonarqube-quality-gate.json')
tests_passed=$((tests_total - tests_failed - tests_skipped))
if [ "${tests_passed}" -lt 0 ]; then payload = {"status": "ERROR", "note": "missing SONARQUBE_HOST_URL and/or SONARQUBE_PROJECT_KEY"}
tests_passed=0 if host and project_key:
fi query = urllib.parse.urlencode({"projectKey": project_key})
coverage_percent="$(jq -r '.coverage_percent // 0' build/quality-summary.json 2>/dev/null || echo 0)" request = urllib.request.Request(f"{host}/api/qualitygates/project_status?{query}", method="GET")
over_500="$(jq -r '.source_lines_over_500 // 0' build/quality-summary.json 2>/dev/null || echo 0)" if token:
cat > build/test-summary.json <<EOF encoded = base64.b64encode(f"{token}:".encode("utf-8")).decode("utf-8")
{ request.add_header("Authorization", f"Basic {encoded}")
"tests": ${tests_total}, try:
"passed": ${tests_passed}, with urllib.request.urlopen(request, timeout=12) as response:
"failed": ${tests_failed}, payload = json.loads(response.read().decode("utf-8"))
"errors": ${tests_errors}, except Exception as exc: # noqa: BLE001
"skipped": ${tests_skipped}, payload = {"status": "ERROR", "error": str(exc)}
"coverage_percent": ${coverage_percent}, Path(sonar_report).write_text(json.dumps(payload, indent=2, sort_keys=True) + "\\n", encoding="utf-8")
"source_lines_over_500": ${over_500}
} ironbank_report = Path(os.getenv('QUALITY_GATE_IRONBANK_REPORT', 'build/ironbank-compliance.json'))
if not ironbank_report.exists():
status = os.getenv('IRONBANK_COMPLIANCE_STATUS', '').strip()
compliant = os.getenv('IRONBANK_COMPLIANT', '').strip().lower()
ironbank_payload = {
"status": status or "unknown",
"compliant": compliant in {"1", "true", "yes", "on"} if compliant else None,
}
ironbank_payload = {k: v for k, v in ironbank_payload.items() if v is not None}
if "status" not in ironbank_payload:
ironbank_payload["status"] = "unknown"
ironbank_payload["note"] = (
"Set IRONBANK_COMPLIANCE_STATUS/IRONBANK_COMPLIANT "
"or write build/ironbank-compliance.json in image-building repos."
)
ironbank_report.parent.mkdir(parents=True, exist_ok=True)
ironbank_report.write_text(json.dumps(ironbank_payload, indent=2, sort_keys=True) + "\\n", encoding="utf-8")
PY
set +e
bash scripts/check.sh
gate_rc=$?
set -e
if [ ! -f build/go-test.json ]; then
: > build/go-test.json
fi
tests_total="$(jq -s '[.[] | select(.Test != null and (.Action=="pass" or .Action=="fail" or .Action=="skip"))] | length' build/go-test.json 2>/dev/null || echo 0)"
tests_failed="$(jq -s '[.[] | select(.Test != null and .Action=="fail")] | length' build/go-test.json 2>/dev/null || echo 0)"
tests_skipped="$(jq -s '[.[] | select(.Test != null and .Action=="skip")] | length' build/go-test.json 2>/dev/null || echo 0)"
tests_errors="$(jq -s '[.[] | select(.Test == null and .Action=="fail")] | length' build/go-test.json 2>/dev/null || echo 0)"
tests_passed=$((tests_total - tests_failed - tests_skipped))
if [ "${tests_passed}" -lt 0 ]; then
tests_passed=0
fi
coverage_percent="$(jq -r '.coverage_percent // 0' build/quality-summary.json 2>/dev/null || echo 0)"
over_500="$(jq -r '.source_lines_over_500 // 0' build/quality-summary.json 2>/dev/null || echo 0)"
cat > build/test-summary.json <<EOF
{
"tests": ${tests_total},
"passed": ${tests_passed},
"failed": ${tests_failed},
"errors": ${tests_errors},
"skipped": ${tests_skipped},
"coverage_percent": ${coverage_percent},
"source_lines_over_500": ${over_500}
}
EOF EOF
printf '%s\n' "${gate_rc}" > build/test.exitcode printf '%s\n' "${gate_rc}" > build/test.exitcode
''' '''
}
} }
} }
} }
stage('Publish test metrics') { stage('Publish test metrics') {
steps { steps {
container('tester') { container('tester') {
retry(2) { sh '''
sh ''' set -eu
set -eu apt-get update >/dev/null
apt-get update >/dev/null apt-get install -y --no-install-recommends curl jq >/dev/null
apt-get install -y --no-install-recommends curl jq >/dev/null suite="${SUITE_NAME}"
suite="${SUITE_NAME}" gateway="${PUSHGATEWAY_URL}"
gateway="${PUSHGATEWAY_URL}" test_rc="$(cat build/test.exitcode 2>/dev/null || echo 1)"
test_rc="$(cat build/test.exitcode 2>/dev/null || echo 1)" status="ok"
status="ok" if [ "${test_rc}" -ne 0 ]; then
if [ "${test_rc}" -ne 0 ]; then status="failed"
status="failed" fi
fi fetch_counter() {
fetch_counter() { status_name="$1"
status_name="$1" line="$(curl -fsS "${gateway}/metrics" 2>/dev/null | awk -v suite="${suite}" -v status="${status_name}" '
line="$(curl -fsS "${gateway}/metrics" 2>/dev/null | awk -v suite="${suite}" -v status="${status_name}" ' /platform_quality_gate_runs_total/ {
/platform_quality_gate_runs_total/ { if (index($0, "job=\\"platform-quality-ci\\"") && index($0, "suite=\\"" suite "\\"") && index($0, "status=\\"" status "\\"")) {
if (index($0, "job=\\"platform-quality-ci\\"") && index($0, "suite=\\"" suite "\\"") && index($0, "status=\\"" status "\\"")) { print $2
print $2 exit
exit
}
} }
' || true)" }
[ -n "${line}" ] && printf '%s\n' "${line}" || printf '0\n' ' || true)"
} [ -n "${line}" ] && printf '%s\n' "${line}" || printf '0\n'
ok_count="$(fetch_counter ok)" }
failed_count="$(fetch_counter failed)" ok_count="$(fetch_counter ok)"
if [ "${status}" = "ok" ]; then failed_count="$(fetch_counter failed)"
ok_count=$((ok_count + 1)) if [ "${status}" = "ok" ]; then
ok_count=$((ok_count + 1))
else
failed_count=$((failed_count + 1))
fi
tests_passed="$(jq -r '.passed // 0' build/test-summary.json 2>/dev/null || echo 0)"
tests_failed="$(jq -r '.failed // 0' build/test-summary.json 2>/dev/null || echo 0)"
tests_errors="$(jq -r '.errors // 0' build/test-summary.json 2>/dev/null || echo 0)"
tests_skipped="$(jq -r '.skipped // 0' build/test-summary.json 2>/dev/null || echo 0)"
coverage_percent="$(jq -r '.coverage_percent // 0' build/test-summary.json 2>/dev/null || echo 0)"
over_500="$(jq -r '.source_lines_over_500 // 0' build/test-summary.json 2>/dev/null || echo 0)"
tests_check="failed"
if [ "${test_rc}" -eq 0 ] && [ "${tests_failed}" -eq 0 ] && [ "${tests_errors}" -eq 0 ] && [ "${tests_passed}" -gt 0 ]; then
tests_check="ok"
fi
coverage_check="$(awk -v value="${coverage_percent}" 'BEGIN { if ((value + 0) >= 95) { print "ok" } else { print "failed" } }')"
loc_check="failed"
if [ "${over_500}" -eq 0 ]; then
loc_check="ok"
fi
docs_naming_check="not_applicable"
gate_glue_check="ok"
sonarqube_check="not_applicable"
if [ -f build/sonarqube-quality-gate.json ]; then
sonar_status="$(jq -r '.status // .projectStatus.status // .qualityGate.status // empty' build/sonarqube-quality-gate.json 2>/dev/null | tr '[:upper:]' '[:lower:]')"
if [ -n "${sonar_status}" ]; then
case "${sonar_status}" in
ok|pass|passed|success) sonarqube_check="ok" ;;
*) sonarqube_check="failed" ;;
esac
else else
failed_count=$((failed_count + 1)) sonarqube_check="failed"
fi fi
tests_passed="$(jq -r '.passed // 0' build/test-summary.json 2>/dev/null || echo 0)" fi
tests_failed="$(jq -r '.failed // 0' build/test-summary.json 2>/dev/null || echo 0)" supply_chain_check="not_applicable"
tests_errors="$(jq -r '.errors // 0' build/test-summary.json 2>/dev/null || echo 0)" if [ -f build/ironbank-compliance.json ]; then
tests_skipped="$(jq -r '.skipped // 0' build/test-summary.json 2>/dev/null || echo 0)" compliant="$(jq -r '.compliant // empty' build/ironbank-compliance.json 2>/dev/null)"
coverage_percent="$(jq -r '.coverage_percent // 0' build/test-summary.json 2>/dev/null || echo 0)" if [ "${compliant}" = "true" ]; then
over_500="$(jq -r '.source_lines_over_500 // 0' build/test-summary.json 2>/dev/null || echo 0)" supply_chain_check="ok"
tests_check="failed" elif [ "${compliant}" = "false" ]; then
if [ "${test_rc}" -eq 0 ] && [ "${tests_failed}" -eq 0 ] && [ "${tests_errors}" -eq 0 ] && [ "${tests_passed}" -gt 0 ]; then supply_chain_check="failed"
tests_check="ok" else
ironbank_status="$(jq -r '.status // .result // .compliance // empty' build/ironbank-compliance.json 2>/dev/null | tr '[:upper:]' '[:lower:]')"
case "${ironbank_status}" in
ok|pass|passed|success|compliant) supply_chain_check="ok" ;;
"") supply_chain_check="failed" ;;
*) supply_chain_check="failed" ;;
esac
fi fi
coverage_check="$(awk -v value="${coverage_percent}" 'BEGIN { if ((value + 0) >= 95) { print "ok" } else { print "failed" } }')" fi
loc_check="failed" if ! cat <<METRICS | curl -fsS --data-binary @- "${gateway}/metrics/job/platform-quality-ci/suite/${suite}" >/dev/null; then
if [ "${over_500}" -eq 0 ]; then echo "warning: metrics push failed for suite=${suite}" >&2
loc_check="ok" fi
fi
if ! cat <<METRICS | curl -fsS --data-binary @- "${gateway}/metrics/job/platform-quality-ci/suite/${suite}" >/dev/null; then
echo "warning: metrics push failed for suite=${suite}" >&2
# TYPE platform_quality_gate_runs_total counter # TYPE platform_quality_gate_runs_total counter
platform_quality_gate_runs_total{suite="${suite}",status="ok"} ${ok_count} platform_quality_gate_runs_total{suite="${suite}",status="ok"} ${ok_count}
platform_quality_gate_runs_total{suite="${suite}",status="failed"} ${failed_count} platform_quality_gate_runs_total{suite="${suite}",status="failed"} ${failed_count}
@ -217,10 +289,12 @@ platform_quality_gate_source_lines_over_500_total{suite="${suite}"} ${over_500}
soteria_quality_gate_checks_total{suite="${suite}",check="tests",result="${tests_check}"} 1 soteria_quality_gate_checks_total{suite="${suite}",check="tests",result="${tests_check}"} 1
soteria_quality_gate_checks_total{suite="${suite}",check="coverage",result="${coverage_check}"} 1 soteria_quality_gate_checks_total{suite="${suite}",check="coverage",result="${coverage_check}"} 1
soteria_quality_gate_checks_total{suite="${suite}",check="loc",result="${loc_check}"} 1 soteria_quality_gate_checks_total{suite="${suite}",check="loc",result="${loc_check}"} 1
soteria_quality_gate_checks_total{suite="${suite}",check="docs_naming",result="${docs_naming_check}"} 1
soteria_quality_gate_checks_total{suite="${suite}",check="gate_glue",result="${gate_glue_check}"} 1
soteria_quality_gate_checks_total{suite="${suite}",check="sonarqube",result="${sonarqube_check}"} 1
soteria_quality_gate_checks_total{suite="${suite}",check="supply_chain",result="${supply_chain_check}"} 1
METRICS METRICS
fi '''
'''
}
} }
} }
} }