dependency-check / dependency-check/dependency-check-sonar-plugin

Not resolving ENV var in GitHub Actions

Open
#717 6 comments 0 reactions 0 assignees View on GitHub
bug lifecycle/frozen
Dominant language
Java
Stars
694
Forks
146
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
Plugin does not resolve env vars to determine path.

If I hardcode the `sonar.dependencyCheck.htmlReportPath` as `/runner/_work/MyProject/MyProject/build/reports/dependency-check-report.html` then everything works as expected.
But I need to set the path in such a way that it works for all my projects, so I tried configuring the path in SonarQube like this:
```
${{github.workspace}}/build/reports/dependency-check-report.html
${GITHUB_WORKSPACE}/build/reports/dependency-check-report.html
${DEPENDENCY_REPORT_PATH}/dependency-check-report.html
```
But none of those worked.

I also tried setting the path via `systemProp.sonar.dependencyCheck.htmlReportPath` in `gradle.properties`

However, I have confirmed that it is the correct path, since I have an upload artifact step that uses that same path.

**To Reproduce**
Github Actions workflow steps:
```
- name: Prepare dependency report
run: ./gradlew dependencyCheckAggregate

- name: Upload dependency check results
uses: actions/upload-artifact@master
with:
name: dependency check reporty
path: ${{ github.workspace }}/build/reports

- name: Build and analyze
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
DEPENDENCY_REPORT_PATH: "${{ github.workspace }}/build/reports"
run: ./gradlew build sonarqube -x test --info
```

**Current behavior**
Error: `No HTML-Report found. Please check property sonar.dependencyCheck.htmlReportPath`

**Expected behavior**
It should resolve the env var and find the file

**Versions:**

- dependency-check: 7.3.0
- sonarqube: 9.6
- dependency-check-sonar-plugin: 3.0.1

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.