如何将SonarQube集成至Docker Compose并解决CI/CD依赖问题

1. 将SonarQube整合到Docker Compose #

直接在docker-compose-staging.yml中添加SonarQube及其依赖的PostgreSQL服务，实现与其他容器一同启动：

services:
  # 保留原有所有服务定义...
  
  sonarqube:
    image: sonarqube:latest
    ports:
      - "9000:9000"
    environment:
      - SONAR_JDBC_URL=jdbc:postgresql://sonar-postgres:5432/sonar
      - SONAR_JDBC_USERNAME=sonar
      - SONAR_JDBC_PASSWORD=sonar
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions
      - sonarqube_logs:/opt/sonarqube/logs
    depends_on:
      - sonar-postgres

  sonar-postgres:
    image: postgres:13
    environment:
      - POSTGRES_USER=sonar
      - POSTGRES_PASSWORD=sonar
      - POSTGRES_DB=sonar
    volumes:
      - sonar_postgres_data:/var/lib/postgresql/data

volumes:
  # 保留原有所有卷定义...
  sonarqube_data:
  sonarqube_extensions:
  sonarqube_logs:
  sonar_postgres_data:

2. 调整CI/CD依赖顺序，解决扫描前置条件 #

新增一个sonar-setup作业，负责启动SonarQube并等待服务就绪，作为所有模块Sonar扫描作业的前置依赖：

name: Deployment-CI/CD

on:
  push:
    branches:
      - v3.0.0_workflows_single_job
  pull_request:
    branches:
      - "master"
    types: [closed]

jobs:
  # 新增：启动SonarQube并等待就绪
  sonar-setup:
    name: SonarQube Setup 🛠️
    runs-on: self-hosted
    steps:
      - name: Checkout branch 🛎️
        uses: actions/checkout@v3
      - name: Start SonarQube stack 🐳
        run: docker-compose -f docker-compose-staging.yml up -d sonarqube sonar-postgres
      - name: Wait for SonarQube ready ⏳
        run: |
          until curl -s http://localhost:9000/api/system/status | grep -q '"status":"UP"'; do
            sleep 10
          done

  # 保留原有作业，给所有Sonar扫描作业添加依赖
  documentation-CI:
    name: documentation-CI 📚
    uses: ./.github/workflows/documentation.yml

  article-CI:
    name: article-CI 🚀
    uses: ./.github/workflows/SJ.yml
    needs: sonar-setup  # 依赖SonarQube启动完成
    with:
      java_version: 18
      working_directory: ./article
      sonar_project_key: Article_Module
      sonar_project_name: "Article Module"
      sonar_host_url: http://localhost:9000
      sonar_token: ${{ secrets.SONAR_TOKEN }}  # 改用GitHub Secrets存储Token

  farmer-CI:
    name: farmer-CI 🚀
    uses: ./.github/workflows/SJ.yml
    needs: sonar-setup
    with:
      java_version: 18
      working_directory: ./farmer
      sonar_project_key: Farmer_Module
      sonar_project_name: "Farmer Module"
      sonar_host_url: http://localhost:9000
      sonar_token: ${{ secrets.SONAR_TOKEN }}

  transport-CI:
    name: transport-CI 🚀
    uses: ./.github/workflows/SJ.yml
    needs: sonar-setup
    with:
      java_version: 18
      working_directory: ./transport
      sonar_project_key: Transport_Module
      sonar_project_name: "Transport Module"
      sonar_host_url: http://localhost:9000
      sonar_token: ${{ secrets.SONAR_TOKEN }}

  client-CI:
    name: client-CI 🚀
    uses: ./.github/workflows/clientDev.yml

  image-build:
    name: Docker image build 🐋
    runs-on: self-hosted
    needs: [client-CI, transport-CI, farmer-CI, article-CI, documentation-CI]
    steps:
      - name: Checkout branch 🛎️
        uses: actions/checkout@v3
      - name: Set up JDK 18 🏗️
        uses: actions/setup-java@v3
        with:
          java-version: 18
          distribution: 'temurin'
          cache: maven
      - name: Create Docker images with JIB  🐋️
        run: mvn -T 2C compile package jib:dockerBuild -e

  container-creation:
    name: Docker container creation 🐳
    runs-on: self-hosted
    needs: image-build
    steps:
      - name: Checkout branch 🛎️
        uses: actions/checkout@v3
      - name: Build and start all containers 🐳
        run: docker-compose -f docker-compose-staging.yml up --build -d

3. 优化代码重复的关键措施 #

• 全局参数复用：在GitHub仓库Settings > Secrets and variables > Actions中定义SONAR_HOST_URL、SONAR_TOKEN等全局变量，SJ.yml模板直接引用这些变量，避免每个模块重复配置。
• 拆分Docker Compose文件：将SonarQube服务定义抽成单独的docker-compose-sonar.yml，在主文件中通过include引入，便于单独维护：

  # docker-compose-staging.yml
  include:
    - docker-compose-sonar.yml
  # 原有服务定义...
  

• 固化CI模板：确保SJ.yml作为通用扫描模板，所有模块仅传递差异化参数（如项目Key、工作目录），核心扫描逻辑统一维护。

额外注意事项 #

• SonarQube首次启动初始化时间较长，sonar-setup中的等待逻辑需保证可靠性，避免扫描作业连接失败。
• 禁止在工作流文件中硬编码SonarToken，必须使用GitHub Secrets存储敏感信息。
• 若自托管Runner与Docker容器不在同一网络，需调整sonar_host_url为可访问地址，或将Runner加入Docker网络。

内容的提问来源于stack exchange，提问作者Stoyan Grozdev