[CI] Send Java and ruby tests to sonarqube simultaneously (#15810)

* Ruby code coverage with SimpleCov json formatter

* [CI] Send Java and ruby tests to sonarqube simultaneously

* Enabled COVERAGE for ruby tests

* Enabled COVERAGE for ruby tests

* Enabled COVERAGE for ruby tests

* Enabled COVERAGE for ruby tests

* Enabled COVERAGE for ruby tests

* Added compiled classes to artifacts

* Test change

* Removed test changes

* Returned back ENABLE_SONARQUBE condition

* Removed debug line

* Diable Ruby coverage if ENABLE_SONARQUBE is not true

* Run sonar scan on pull requests and onn push to main

* Run sonar can on release branches

.buildkite/pull_request_pipeline.yml

@@ -34,6 +34,8 @@ steps:
 
       source .buildkite/scripts/common/container-agent.sh
       ci/unit_tests.sh ruby
+    artifact_paths:
+      - "coverage/coverage.json"
 
   - label: ":java: Java unit tests"
     key: "java-unit-tests"
@@ -45,19 +47,37 @@ steps:
     retry:
       automatic:
         - limit: 3
+    env:
+      ENABLE_SONARQUBE: true
     command: |
-      set -euo pipefail
+      set -euo pipefail      
-      if [[ $BUILDKITE_PULL_REQUEST == "false" ]]; then
-        # https://github.com/elastic/logstash/pull/15486 for background
-        export ENABLE_SONARQUBE="false"
-      else
-        source .buildkite/scripts/pull-requests/sonar-env.sh
-      fi
-
       source .buildkite/scripts/common/container-agent.sh
       ci/unit_tests.sh java
     artifact_paths:
       - "**/build/test-results/javaTests/TEST-*.xml"
+      - "**/jacocoTestReport.xml"
+      - "**/build/classes/**/*.*"
+
+  - label: ":sonarqube: Continuous Code Inspection"
+    if: | 
+      build.pull_request.id != null || 
+      build.branch == "main" || 
+      build.branch =~ /^[0-9]+\.[0-9]+\$/
+    env:
+      VAULT_SONAR_TOKEN_PATH: "kv/ci-shared/platform-ingest/elastic/logstash/sonar-analyze-token"
+    agents:
+      image: "docker.elastic.co/cloud-ci/sonarqube/buildkite-scanner:latest"
+    command:
+      - "buildkite-agent artifact download --step ruby-unit-tests coverage/coverage.json ."
+      - "buildkite-agent artifact download --step java-unit-tests **/jacocoTestReport.xml ."
+      - "buildkite-agent artifact download --step java-unit-tests **/build/classes/**/*.* ."
+      - "/scan-source-code.sh"
+    depends_on:
+      - "ruby-unit-tests"
+      - "java-unit-tests"
+    retry:
+      manual:
+        allowed: true
 
   - label: ":lab_coat: Integration Tests / part 1"
     key: "integration-tests-part-1"

.buildkite/scripts/pull-requests/sonar-env.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-SONAR_TOKEN_PATH="kv/ci-shared/platform-ingest/elastic/logstash/sonar-creds"
-export SONAR_TOKEN=$(retry -t 5 -- vault kv get -field=token ${SONAR_TOKEN_PATH})
-
-export SOURCE_BRANCH=$GITHUB_PR_BRANCH
-export TARGET_BRANCH=$GITHUB_PR_TARGET_BRANCH
-export PULL_ID=$GITHUB_PR_NUMBER
-export COMMIT_SHA=$BUILDKITE_COMMIT

Gemfile.template

@@ -26,10 +26,12 @@ gem "benchmark-ips", :group => :development
 gem "ci_reporter_rspec", "~> 1", :group => :development
 gem "flores", "~> 0.0.8", :group => :development
 gem "json-schema", "~> 2", :group => :development
-gem "logstash-devutils", "~> 2", :group => :development
+gem "logstash-devutils", "~> 2.6.0", :group => :development
 gem "rack-test", :require => "rack/test", :group => :development
 gem "rspec", "~> 3.5", :group => :development
 gem "webmock", "~> 3", :group => :development
+gem "simplecov", "~> 0.22.0", :group => :development
+gem "simplecov-json", require: false, :group => :development
 gem "jar-dependencies", "= 0.4.1" # Gem::LoadError with jar-dependencies 0.4.2
 gem "murmurhash3", "= 0.1.6" # Pins until version 0.1.7-java is released
 gem "thwait"

ci/docker_unit_tests.sh

@@ -1,10 +1,3 @@
 #!/bin/bash
-# Init vault
-VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID")
-export VAULT_TOKEN
-unset VAULT_ROLE_ID VAULT_SECRET_ID
 
-SONAR_TOKEN=$(vault read -field=token secret/logstash-ci/sonar-creds)
+ci/docker_run.sh logstash-unit-tests ci/unit_tests.sh $@
-unset VAULT_TOKEN
-DOCKER_ENV_OPTS="-e SONAR_TOKEN=${SONAR_TOKEN} -e SOURCE_BRANCH=$ghprbSourceBranch -e TARGET_BRANCH=$ghprbTargetBranch -e PULL_ID=$ghprbPullId -e COMMIT_SHA=$branch_specifier" \
- ci/docker_run.sh logstash-unit-tests ci/unit_tests.sh $@

ci/unit_tests.sh

@@ -19,24 +19,13 @@ fi
 
 SELECTED_TEST_SUITE=$1
 
+SONAR_ARGS=()
+if [[ $(echo $ENABLE_SONARQUBE | tr '[:lower:]' '[:upper:]') == "TRUE" ]]; then
+  SONAR_ARGS=("jacocoTestReport")
+  export COVERAGE=true
+fi
+
 if [[ $SELECTED_TEST_SUITE == $"java" ]]; then
-  SONAR_ARGS=()
-
-  if [[ $(echo $ENABLE_SONARQUBE | tr '[:lower:]' '[:upper:]') == "TRUE" ]]; then
-    SONAR_ARGS=(
-      "jacocoTestReport"
-      "sonar"
-      "-Dsonar.token=${SONAR_TOKEN}"
-      "-Dsonar.host.url=https://sonar.elastic.dev"
-      "-Dsonar.projectKey=elastic_logstash_AYm_nEbQaV3I-igkX1q9"
-      "-Dsonar.projectName=logstash"
-      "-Dsonar.pullrequest.key=$PULL_ID"
-      "-Dsonar.pullrequest.branch=$SOURCE_BRANCH"
-      "-Dsonar.pullrequest.base=$TARGET_BRANCH"
-      "-Dsonar.scm.revision=$COMMIT_SHA"
-    )
-  fi
-
   echo "Running Java Tests"
   ./gradlew javaTests "${SONAR_ARGS[@]}" --console=plain --warning-mode all
 elif [[ $SELECTED_TEST_SUITE == $"ruby" ]]; then

logstash-core/lib/logstash/modules/logstash_config.rb

@@ -34,7 +34,6 @@ module LogStash module Modules class LogStashConfig
   def configured_inputs(default = [], aliases = {})
     name = "var.inputs"
     values = get_setting(LogStash::Setting::SplittableStringArray.new(name, String, default))
-
     aliases.each { |k, v| values << v if values.include?(k) }
     aliases.invert.each { |k, v| values << v if values.include?(k) }
     values.flatten.uniq

sonar-project.properties

@@ -0,0 +1,11 @@
+sonar.projectKey=elastic_logstash_AYm_nEbQaV3I-igkX1q9
+sonar.host.url=https://sonar.elastic.dev
+
+sonar.exclusions=vendor/**, gradle/**, rakelib/**, logstash-core-plugin-api/**, licenses/**, qa/**, spec/**
+
+# Ruby
+sonar.ruby.coverage.reportPaths=coverage/coverage.json
+
+# Java
+sonar.coverage.jacoco.xmlReportPaths=**/jacocoTestReport.xml
+sonar.java.binaries=**/build/classes

spec/spec_helper.rb

@@ -21,7 +21,6 @@ require "flores/rspec"
 require "flores/random"
 require "pathname"
 require "stud/task"
-require "logstash/devutils/rspec/spec_helper"
 require "support/resource_dsl_methods"
 require "support/mocks_classes"
 require "support/helpers"
@@ -34,6 +33,19 @@ require 'rspec'
 require "json"
 require 'logstash/runner'
 
+# Code coverage setup
+if ENV['COVERAGE']
+  require 'simplecov'
+  require 'simplecov-json'
+
+  SimpleCov.formatter = SimpleCov::Formatter::JSONFormatter
+
+  SimpleCov.start do
+    add_filter 'spec/'
+    add_filter 'vendor/'
+  end
+end
+
 class JSONIOThingy < IO
   def initialize; end
   def flush; end
@@ -52,6 +64,12 @@ RSpec.configure do |c|
   c.include LogStashHelper
   c.extend LogStashHelper
 
+  if ENV['COVERAGE']
+    c.after(:suite) do
+      SimpleCov.result.format!
+    end
+  end
+
   # Some tests mess with LogStash::SETTINGS, and data on the filesystem can leak state
   # from one spec to another; run each spec with its own temporary data directory for `path.data`
   c.around(:each) do |example|