mirror of
https://github.com/ankitects/anki.git
synced 2026-10-19 06:19:40 +08:00
Fernando Lins
f4c684a96e
## Linked issue Fixes #5657 ## Summary / motivation SonarCloud PR analysis derives the changed-file set from git and requires the target branch to be present in the local repository. The scan checks out only the fork's head history (`fetch-depth: 0` on the head ref), so the base branch was never fetched. Without a base to diff against, the scanner attributed every analysed file to the PR as new code, e.g. 977 files on the single-file change in #5641 (`qt/aqt/preferences.py`), and recurring noise in `tools/`. This adds a step that fetches the target branch from the trusted upstream repository (`github.repository`, never the fork) and pins it locally under the name passed as `sonar.pullrequest.base`, so new code is measured against the real PR diff. It does not disable any rule or exclude any file. The isolation boundary is preserved: the upstream branch is read as data only, nothing is built or executed, the trusted config and no-fork-code-execution constraints are unchanged, and the Quality Gate stays informative. ## Steps to reproduce 1. Open a fork PR that changes a single file (e.g. #5641, base `main`). 2. Let CI complete and the SonarCloud workflow run. 3. Observe SonarCloud reporting new-code issues across hundreds of unchanged files (~977) instead of only the changed file. ## How to test ### Details Reproduced the scanner's git-based new-code computation locally against the exact commits from #5641: - head = `1e7914a` - base branch `main` fetched from upstream → `merge-base` = `bdeec0877`, which matches the PR's `baseRefOid` reported by the GitHub API. - `git diff --name-only <merge-base> <head>` → **only** `qt/aqt/preferences.py`. The new step also logs the analysed commit, base repo/branch, base commit and merge-base, and fails closed if the base reference cannot be resolved (no silent fallback to a missing base). YAML parse and the cog-generated `docs/sonarcloud.md` sync were verified. ## Before / after behavior - Before: fork/PR scan treats all indexed files as new code (977 files for a one-file PR). - After: only the files actually changed vs the upstream base are considered new code.