From e1ffa041414eb80d1abe26daf282d2532f599be9 Mon Sep 17 00:00:00 2001
From: Kristóf Marussy <kristof@marussy.com>
Date: Sun, 21 Nov 2021 17:20:32 +0100
Subject: ci: make sonar analysis conditional

Check for the presence of the secret directly (instead of whether we're
in a pull request) for a more robust CI.

We check the secret according to
https://github.community/t/how-can-i-test-if-secrets-are-available-in-an-action/17911

To determine the clone depth (deep for sonar analysis, shallow
otherwise) we use the "fake ternary" method from
https://github.community/t/do-expressions-support-ternary-operators-to-change-their-returned-value/18114
---
 .github/workflows/build.yml | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5c2893a9..de55ffcf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,7 +2,8 @@ name: Build
 on:
   push:
     branches:
-      - main
+      - '**'
+      - '!gh-pages'
   pull_request:
     types: [opened, synchronize, reopened]
 jobs:
@@ -10,10 +11,16 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
+      - name: Check for Sonar secret
+        id: check-secret
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          echo "::set-output name=is_SONAR_TOKEN_set::${{ env.SONAR_TOKEN != '' }}"
       - name: Checkout code
         uses: actions/checkout@v2
         with:
-          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of SonarCloud analysis
+          fetch-depth: ${{ !steps.check-secret.is_SONAR_TOKEN_set && 1 || 0 }}  # Shallow clones should be disabled for a better relevancy of SonarCloud analysis
       - name: Set up JDK 17
         uses: actions/setup-java@v1
         with:
@@ -27,11 +34,13 @@ jobs:
           restore-keys: ${{ runner.os }}-gradle
       - name: Cache Sonar packages
         uses: actions/cache@v2
+        if: ${{ steps.check-secret.is_SONAR_TOKEN_set }}
         with:
-          path: ~/.sonar/cache
+          path: |
+            ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
-      - name: Cache yarn packages
+      - name: Cache node distribution
         uses: actions/cache@v2
         with:
           path: |
@@ -45,12 +54,14 @@ jobs:
             **/.yarn/cache
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
           restore-keys: ${{ runner.os }}-yarn
+      - name: Gradle build
+        if: ${{ !steps.check-secret.is_SONAR_TOKEN_set }}
+        run: |
+          ./gradlew build -Pci --info
       - name: Gradle build and Sonar analyze
-        if: ${{ github.event_name != 'pull_request' }}
+        if: ${{ steps.check-secret.is_SONAR_TOKEN_set }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed by Sonar to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: ./gradlew build sonarqube -Pci --info
-      - name: Gradle build for pull request
-        if: ${{ github.event_name == 'pull_request' }}
-        run: ./gradlew build --info
+        run: |
+          ./gradlew build sonarqube -Pci --info
-- 
cgit v1.2.3-70-g09d2