Run Sonar on push so branch baselines stop going stale - #78
aleksandar-apostolov wants to merge 1 commit into
Conversation
The Sonar step was gated on `github.event.pull_request.head.repo.full_name == github.repository`. On a push there is no pull_request object, so the left side is the empty string and the guard is always false. Sonar has therefore only ever run on pull requests, and a PR analysis does not refresh the branch baseline. Consumers have been measuring "new code" against a baseline frozen at the day they adopted this workflow: stream-core-android last analysed 2025-12-23 (the day it was created), stream-video-android 2025-12-19, stream-feeds-android 2025-10-15. Keep the fork and Dependabot guards, but apply the fork check only to pull_request events. The same stale condition also made the sibling "skipped because the PR comes from a fork" notice fire on every push, reporting the wrong reason in the log.
aleksandar-apostolov
added
the
pr:workflows
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR checklist ✅All required conditions are satisfied:
🎉 Great job! This PR is ready for review. |
| if: >- | ||
| github.actor != 'dependabot[bot]' && | ||
| (github.event_name != 'pull_request' || | ||
| github.event.pull_request.head.repo.full_name == github.repository) |
There was a problem hiding this comment.
This gate is "not a PR" rather than "is a push", so it also admits merge_group and workflow_dispatch, both of which were skipped before.
merge_group matters in one consumer: stream-chat-android's pr-checks.yml triggers on pull_request and merge_group, and that repo has a real coverage { includedModules = ... } block, so ./gradlew sonar does real work there. On a merge-queue run GITHUB_REF is refs/heads/gh-readonly-queue/develop/pr-N-<sha>, and CoverageConfiguration.kt sets no sonar.branch.name, so the scanner auto-detects that throwaway ref. Net effect: a second full Sonar run per PR, a junk SonarCloud branch per queue entry, and a Sonar failure inside the already-required unit-test job can block the merge queue. Chat gains nothing in exchange, since it already runs Sonar on push through its own build-and-test.yml.
workflow_dispatch has the same shape in feeds, core and video: dispatching CI on a feature branch would register that branch in SonarCloud.
Suggesting the explicit push form. I checked what it costs: nothing for core, video and feeds, whose push triggers are exactly develop/main, and it restores today's behaviour for chat's merge queue.
| if: >- | |
| github.actor != 'dependabot[bot]' && | |
| (github.event_name != 'pull_request' || | |
| github.event.pull_request.head.repo.full_name == github.repository) | |
| if: >- | |
| github.actor != 'dependabot[bot]' && | |
| (github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository)) |
This branch has not been deployed
2 participants
Goal
Fixes AND-1443
The Sonar step is gated on
github.event.pull_request.head.repo.full_name == github.repository. On a push there is nopull_requestobject, so the guard isalways false and Sonar only ever runs on PRs — which never refreshes the branch
baseline. Consumers have been measuring new code against a baseline frozen since
they adopted this workflow: core 2025-12-23, video 2025-12-19, feeds 2025-10-15.
Implementation
Scope the fork check to
pull_requestevents; keep the Dependabot guard on allevents. The same condition made the sibling "skipped because the PR comes from a
fork" notice fire on every push, so that one is scoped too.
SONAR_TOKENis a repo secret in all three consuming repos and already passed intothis workflow, so it is available to push-event runs.
Testing
actionlint .github/workflows/android-ci.yml— clean.Evaluated both conditions per event type: push and
workflow_dispatchnow run Sonar;same-repo PRs unchanged; fork and Dependabot PRs still skipped, with the correct
notice.
Consumers pin this workflow by SHA, so each repo needs its
android.ymlbumpedbefore it takes effect.