Sonarcloud integration

[matusso]

PR Type

enhancement, configuration changes

---

Description

• Introduced GitHub Actions workflows for SonarCloud scanning across multiple projects: Metasploit Framework, mvt-project, and RouterSploit.
• Configured environments and dependencies for Ruby and Python projects to facilitate SonarCloud analysis.
• Set up SonarCloud scans with specific exclusions and project configurations.
• Added SonarLint connected mode configuration in VSCode settings for enhanced code quality checks.

---

Changes walkthrough 📝

Relevant files

Configuration changes

metasploit-framework_sonarcloud.yml Add SonarCloud workflow for Metasploit Framework                  .github/workflows/metasploit-framework_sonarcloud.yml Added a GitHub Actions workflow for SonarCloud scanning of Metasploit Framework. Configured Ruby environment and dependencies. Set up SonarCloud scan with specific exclusions. +56/-0    mvt-project_sonarcloud.yml Add SonarCloud workflow for mvt-project                                    .github/workflows/mvt-project_sonarcloud.yml Added a GitHub Actions workflow for SonarCloud scanning of mvt-project. Configured Python environment and dependencies. Integrated SonarCloud scan with specific settings. +60/-0    routersploit_sonarcloud.yml Add SonarCloud workflow for RouterSploit                                  .github/workflows/routersploit_sonarcloud.yml Added a GitHub Actions workflow for SonarCloud scanning of RouterSploit. Configured Python environment and dependencies. Implemented SonarCloud scan with project-specific configurations. +50/-0    settings.json Configure SonarLint connected mode settings                            .vscode/settings.json Configured SonarLint connected mode for the project. Set connection ID and project key for SonarLint. +6/-0

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[qodo-merge-pro-for-open-source]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Sensitive information exposure: The workflows use SONAR_TOKEN secret but there's no check to ensure the secret is not exposed in logs or error messages. While GitHub Actions automatically redacts secrets from logs, additional precautions might be needed when handling scan results and error outputs.

⚡ Recommended focus areas for review Configuration Issue Python version 3.13 is specified but it's not yet released and stable. Should use a stable Python version like 3.11 or 3.12 Configuration Issue Python version 3.13 is specified but it's not yet released and stable. Should use a stable Python version like 3.11 or 3.12 Error Handling Using continue-on-error:true means SonarCloud scan failures won't fail the workflow. Consider if this is the desired behavior for code quality enforcement

[qodo-merge-pro-for-open-source]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Possible issue	Use a stable Python version instead of an alpha/preview release for production workflows Python 3.13 is currently in alpha and not stable for production use. Use a stable Python version like 3.11 or 3.12 instead. .github/workflows/mvt-project_sonarcloud.yml [25-28] - name: Set up Python uses: actions/setup-python@v4 with: - python-version: '3.13' + python-version: '3.12' Apply this suggestion Suggestion importance[1-10]: 9 Why: Using Python 3.13 (alpha) in a production workflow is risky as it's unstable and may have bugs. Switching to a stable version like 3.12 is crucial for reliability.	9
Security	Remove error suppression to ensure code quality/security issues are properly caught Using 'continue-on-error: true' for the SonarCloud scan step means failures won't be caught, potentially allowing quality/security issues to be merged. Remove this flag to ensure scan failures block the workflow. .github/workflows/metasploit-framework_sonarcloud.yml [40-42] - name: SonarCloud Scan uses: SonarSource/sonarcloud-github-action@v4 - continue-on-error: true Apply this suggestion Suggestion importance[1-10]: 8 Why: Allowing the SonarCloud scan to continue on error could mask critical security and quality issues. Removing continue-on-error ensures proper enforcement of code quality standards.	8

💡 Need additional feedback ? start a PR chat