From f9dd295188347d1aee2e2f515965d768a7dd296c Mon Sep 17 00:00:00 2001
From: Dillon Beresford <165616268+bwdil@users.noreply.github.com>
Date: Fri, 17 May 2024 17:49:48 -0500
Subject: [PATCH] [PM-7288] Include changes to actions in scan workflow (#87)

---
 .github/workflows/scan.yml | 16 +++++++++-------
 app/build.gradle.kts       | 17 +++++++++++++++++
 build.gradle.kts           |  3 ++-
 gradle/libs.versions.toml  |  2 ++
 4 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index f98e5c4358..27a986d6ae 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -40,12 +40,15 @@ jobs:
           base_uri: https://ast.checkmarx.net/
           cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
           cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
-          # additional_params: --report-format sarif --output-path . ${{ env.INCREMENTAL }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path . ${{ env.INCREMENTAL }}
 
-      # - name: Upload Checkmarx results to GitHub
-      #   uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
-      #   with:
-      #     sarif_file: cx_result.sarif
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
+        with:
+          sarif_file: cx_result.sarif
 
   quality:
     name: Quality scan
@@ -68,8 +71,7 @@ jobs:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          # TODO: see https://docs.sonarsource.com/sonarcloud/advanced-setup/analysis-parameters/
-          # for parameters to configure
           args: >
             -Dsonar.organization=${{ github.repository_owner }}
             -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
+
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 1ea79754fe..11a9f3b147 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -8,6 +8,7 @@ plugins {
     alias(libs.plugins.kotlinx.kover)
     alias(libs.plugins.ksp)
     alias(libs.plugins.google.services)
+    alias(libs.plugins.sonarqube)
 }
 
 android {
@@ -127,3 +128,19 @@ dependencies {
 
     androidTestImplementation(libs.bundles.tests.instrumented)
 }
+
+sonar {
+    properties {
+        property("sonar.projectKey", "bitwarden_authenticator-android")
+        property("sonar.organization", "bitwarden")
+        property("sonar.host.url", "https://sonarcloud.io")
+        property("sonar.sources", "src/main/,src/debug/")
+        property("sonar.tests", "src/test/")
+    }
+}
+
+tasks {
+    getByName("sonar") {
+        dependsOn("check")
+    }
+} 
diff --git a/build.gradle.kts b/build.gradle.kts
index 96bef4a2ec..4746dfa74d 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -7,4 +7,5 @@ plugins {
     alias(libs.plugins.kotlinx.kover) apply false
     alias(libs.plugins.ksp) apply false
     alias(libs.plugins.google.services) apply false
-}
\ No newline at end of file
+    alias(libs.plugins.sonarqube) apply false
+}
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index a71ee4dab9..3e47821bba 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -51,6 +51,7 @@ okhttp = "4.12.0"
 retrofit = "2.11.0"
 retrofitKotlinxSerialization = "1.0.0"
 roboelectric = "4.12.1"
+sonarqube = "5.0.0.4638" 
 turbine = "1.1.0"
 zxing = "3.5.3"
 
@@ -127,6 +128,7 @@ kotlin-parcelize = { id = "org.jetbrains.kotlin.plugin.parcelize", version.ref =
 kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" }
 kotlinx-kover = { id = "org.jetbrains.kotlinx.kover", version.ref = "kotlinxKover" }
 ksp = { id = "com.google.devtools.ksp", version.ref = "ksp" }
+sonarqube = { id = "org.sonarqube", version.ref = "sonarqube" }
 
 [bundles]
 tests-instrumented = [