Commit 563f4387 authored by Bertrand Goareguer's avatar Bertrand Goareguer
Browse files

Merge branch 'main' into 'main' 

fix: use of $SONAR_AUTH_TOKEN

See merge request to-be-continuous/defectdojo!28
parents e0ab418c 16b69a26

README.md

+2 −2
Original line number Diff line number Diff line
@@ -114,7 +114,7 @@ SonarQube is specific: contrary to other jobs, sonar job does not generate any a 
In order to launch SonarQube HTML-report generation, the following variables must be set:



- SONAR_URL (used by sonar template)

- SONAR_AUTH_TOKEN (used by sonar template)

- SONAR_TOKEN (used by sonar template)

- DEFECTDOJO_SONARQUBE_APPLICATION

- DEFECTDOJO_SONARQUBE_PROJECT_KEY
@@ -133,7 +133,7 @@ sonar-report \ 
    --project="${DEFECTDOJO_SONARQUBE_PROJECT_KEY}" \

    --application="${DEFECTDOJO_SONARQUBE_APPLICATION}" \

    --branch="${CI_COMMIT_REF_NAME}" \

    --sonartoken="${SONAR_AUTH_TOKEN}" \

    --sonartoken="${SONAR_TOKEN}" \

    --sinceleakperiod="${DEFECTDOJO_SONARQUBE_SINCELEAKPERIOD}" \

    --noSecurityHotspot="${DEFECTDOJO_SONARQUBE_NOSECURITYHOTSPOT}" \

    --allbugs="${DEFECTDOJO_SONARQUBE_ALLBUGS}" > "$sonar_report"

templates/gitlab-ci-defectdojo.yml

+7 −2
Original line number Diff line number Diff line
@@ -172,7 +172,12 @@ variables: 
    # Sonar

    # template: sonar

    sonarqube_report=0

    if [ -n "${SONAR_URL}" ] && [ -n "${SONAR_AUTH_TOKEN}" ] && [ -n "${DEFECTDOJO_SONARQUBE_PROJECT_KEY}" ] && [ -n "${DEFECTDOJO_SONARQUBE_APPLICATION}" ]; then

    if [[ "$SONAR_AUTH_TOKEN" ]] && [[ -z "$SONAR_TOKEN" ]]

    then 

      log_warn '$SONAR_AUTH_TOKEN variable detected: use $SONAR_TOKEN instead (see doc)'

      export SONAR_TOKEN="$SONAR_AUTH_TOKEN"

    fi

    if [ -n "${SONAR_URL}" ] && [ -n "${SONAR_TOKEN}" ] && [ -n "${DEFECTDOJO_SONARQUBE_PROJECT_KEY}" ] && [ -n "${DEFECTDOJO_SONARQUBE_APPLICATION}" ]; then

      sonar_report="sonar-report.html"

      log_info "sonar-report will call ${SONAR_URL}/api/issues/search?componentKeys=${DEFECTDOJO_SONARQUBE_PROJECT_KEY}&ps=500&p=1&statuses=OPEN,CONFIRMED,REOPENED&resolutions=&s=STATUS&asc=no&types=VULNERABILITY"

      sonar-report \
@@ -181,7 +186,7 @@ variables: 
      --project="${DEFECTDOJO_SONARQUBE_PROJECT_KEY}" \

      --application="${DEFECTDOJO_SONARQUBE_APPLICATION}" \

      --branch="${CI_COMMIT_REF_NAME}" \

      --sonartoken="${SONAR_AUTH_TOKEN}" \

      --sonartoken="${SONAR_TOKEN}" \

      --sinceleakperiod="${DEFECTDOJO_SONARQUBE_SINCELEAKPERIOD}" \

      --noSecurityHotspot="${DEFECTDOJO_SONARQUBE_NOSECURITYHOTSPOT}" \

      --allbugs="${DEFECTDOJO_SONARQUBE_ALLBUGS}" > "$sonar_report"