From e9f8f2eb09121dd0480de637c68310a056667242 Mon Sep 17 00:00:00 2001 From: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> Date: Tue, 13 Jan 2026 15:38:35 -0800 Subject: [PATCH 1/4] Add SonarQube scanning in github action Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> --- .github/workflows/blossom-ci.yml | 6 ++++++ sonar-project.properties | 1 + 2 files changed, 7 insertions(+) create mode 100644 sonar-project.properties diff --git a/.github/workflows/blossom-ci.yml b/.github/workflows/blossom-ci.yml index be774ec1cc44..ba9ca7e768b4 100644 --- a/.github/workflows/blossom-ci.yml +++ b/.github/workflows/blossom-ci.yml @@ -369,6 +369,12 @@ jobs: ref: ${{ fromJson(needs.Authorization.outputs.args).ref }} lfs: 'true' + - name: Run SonarQube Code Analysis + uses: SonarSource/sonarqube-scan-action@v4 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} + - name: Run blossom action uses: NVIDIA/blossom-action@main env: diff --git a/sonar-project.properties b/sonar-project.properties new file mode 100644 index 000000000000..c62ffc3968f5 --- /dev/null +++ b/sonar-project.properties @@ -0,0 +1 @@ +sonar.projectKey=GPUSW_TensorRT-LLM-Team_TensorRT-LLM_tensorrt-llm From aa5c31488238d86d2da376e9d5447afcea08d33b Mon Sep 17 00:00:00 2001 From: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> Date: Wed, 14 Jan 2026 10:39:48 -0800 Subject: [PATCH 2/4] Add action for sonarqube for testing Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> --- .github/workflows/sonarqube-code-analysis.yml | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/sonarqube-code-analysis.yml diff --git a/.github/workflows/sonarqube-code-analysis.yml b/.github/workflows/sonarqube-code-analysis.yml new file mode 100644 index 000000000000..b91cdd1b19d3 --- /dev/null +++ b/.github/workflows/sonarqube-code-analysis.yml @@ -0,0 +1,37 @@ +name: SonarQube + +on: + push: + branches: + - main + pull_request: + types: [opened, synchronize, reopened] + workflow_dispatch: + inputs: + ref: + description: 'commit sha to check' + required: true + +jobs: + build: + name: Build and analyze + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis + ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }} + + - uses: SonarSource/sonarqube-scan-action@v4 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} + # If you wish to fail your job when the Quality Gate is red, uncomment the + # following lines. This would typically be used to fail a deployment. + # We do not recommend to use this in a pull request. Prefer using pull request + # decoration instead. + # - uses: SonarSource/sonarqube-quality-gate-action@v1 + # timeout-minutes: 5 + # env: + # SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} From 35702c682af66df8627b157c412343dda0a54f23 Mon Sep 17 00:00:00 2001 From: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> Date: Wed, 14 Jan 2026 11:16:34 -0800 Subject: [PATCH 3/4] Run on self-hosted machine for SonarQube Scanning Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> --- .github/workflows/blossom-ci.yml | 18 ++++++++++++------ .github/workflows/sonarqube-code-analysis.yml | 8 +------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/blossom-ci.yml b/.github/workflows/blossom-ci.yml index ba9ca7e768b4..7448e21964bc 100644 --- a/.github/workflows/blossom-ci.yml +++ b/.github/workflows/blossom-ci.yml @@ -369,12 +369,6 @@ jobs: ref: ${{ fromJson(needs.Authorization.outputs.args).ref }} lfs: 'true' - - name: Run SonarQube Code Analysis - uses: SonarSource/sonarqube-scan-action@v4 - env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} - - name: Run blossom action uses: NVIDIA/blossom-action@main env: @@ -385,6 +379,18 @@ jobs: args2: ${{ fromJson(needs.Authorization.outputs.args).args2 }} args3: ${{ fromJson(needs.Authorization.outputs.args).args3 }} + SonarQube-scan: + name: SnoarQube scan + needs: [Authorization] + runs-on: blossom + steps: + - name: Run SonarQube Code Analysis + uses: SonarSource/sonarqube-scan-action@v4 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} + + Job-trigger: name: Start ci job needs: [Vulnerability-scan] diff --git a/.github/workflows/sonarqube-code-analysis.yml b/.github/workflows/sonarqube-code-analysis.yml index b91cdd1b19d3..ef693309b917 100644 --- a/.github/workflows/sonarqube-code-analysis.yml +++ b/.github/workflows/sonarqube-code-analysis.yml @@ -1,11 +1,6 @@ name: SonarQube on: - push: - branches: - - main - pull_request: - types: [opened, synchronize, reopened] workflow_dispatch: inputs: ref: @@ -15,8 +10,7 @@ on: jobs: build: name: Build and analyze - runs-on: ubuntu-latest - + runs-on: linux-amd64-cpu8 steps: - uses: actions/checkout@v6 with: From 9f821699e80969855ef775d9dfeca9878939ad53 Mon Sep 17 00:00:00 2001 From: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> Date: Wed, 14 Jan 2026 12:10:11 -0800 Subject: [PATCH 4/4] switch to personal runner Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com> --- .github/workflows/sonarqube-code-analysis.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sonarqube-code-analysis.yml b/.github/workflows/sonarqube-code-analysis.yml index ef693309b917..86e9de2ff6fe 100644 --- a/.github/workflows/sonarqube-code-analysis.yml +++ b/.github/workflows/sonarqube-code-analysis.yml @@ -1,6 +1,11 @@ name: SonarQube on: + push: + branches: + - main + pull_request: + types: [opened, synchronize, reopened] workflow_dispatch: inputs: ref: @@ -10,17 +15,17 @@ on: jobs: build: name: Build and analyze - runs-on: linux-amd64-cpu8 + runs-on: self-hosted steps: - uses: actions/checkout@v6 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }} - - uses: SonarSource/sonarqube-scan-action@v4 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} + # If you wish to fail your job when the Quality Gate is red, uncomment the # following lines. This would typically be used to fail a deployment. # We do not recommend to use this in a pull request. Prefer using pull request