OLMIS-8280: Migrate SonarCloud analysis to Java 21 and drop axios from the Consul script - #5
Merged
Merged
Conversation
Run the analysis through SonarSource/sonarqube-scan-action@v6 (which provisions a Java 21 runtime) instead of the org.sonarqube Gradle plugin, which ran the scanner inside the Gradle 4.10.3 JVM and could not move to Java 21. - Replace the ./gradlew sonarqube step with sonarqube-scan-action@v6 - Add sonar-project.properties (sources, tests, binaries, coverage) - Pass sonar.projectVersion from gradle.properties serviceVersion so New Code (Previous version) is tracked correctly, as the Gradle plugin used to do - Remove the now-unused org.sonarqube plugin/config and the dead sonar service in docker-compose.builder.yml - Stop deleting ./build so sonar.java.binaries finds the compiled classes - Bump checkout/setup-java/cache actions to v4 and drop the redundant JDK step
Replace the axios dependency with the native Node http client in consul/registration.js and remove axios from consul/package.json, mirroring the approach already taken in the UI repos and in openlmis-stockmanagement. The script only talks to the internal Consul agent and the request/retry behaviour is preserved.
|
mgrochalskisoldevelo
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR bundles two BE-wide maintenance changes into one PR (BE builds take hours, so we batch them per the team decision).
1. Migrate SonarCloud analysis to Java 21
Why
SonarCloud Cloud dropped support for running analysis on Java 17, which broke the pipeline. The
org.sonarqube3.3 plugin runs the scanner inside the Gradle JVM, and Gradle 4.10.3 can't run on Java 21 — so the scanner couldn't be moved to a supported Java version in place.What
Decouple the analysis from Gradle. Build, tests and the JaCoCo report stay in the Docker build; the analysis now runs via
SonarSource/sonarqube-scan-action@v6, which provisions a Java 21 runtime for the scanner engine.sonarqube-scan-action@v6instead of./gradlew sonarqubesonar-project.propertiesreproducing the Gradle plugin's scope: sourcessrc/main/java+src/main/resources, testssrc/test/java+src/integration-test/java,sonar.java.source=17, JaCoCo coveragesonar.projectVersionfromgradle.propertiesserviceVersionso New Code (Previous version) is tracked correctly, as the Gradle plugin used to do./buildsosonar.java.binariesfinds the compiled classesorg.sonarqubeGradle plugin, thesonarqube {}block and the deadsonarservice indocker-compose.builder.yml2. Drop the axios dependency from the Consul registration script
Why
axios carries a recurring stream of security advisories. The registration script only makes a few HTTP calls to the internal Consul agent, so it doesn't need a third-party HTTP client.
What
Replace axios with the native Node
httpclient, mirroring the approach already taken in the UI repos and in openlmis-stockmanagement.axiosfromconsul/package.jsonconsul/registration.jsto usehttp.request; the request/retry behaviour is preservedconsul/config.jsonis untouched (it is service-specific)Notes
sonar.java.librariesis not set (dependency jars live inside the Docker build), so expect a lower-precision warning for a subset of Java rules.