refactor: update build and sonar configuration - #8
Conversation
Update sonar-scanner setup to build from source instead of downloading prebuilt binaries. This requires installing additional dependencies including maven and cmake. Reorganize workflow steps to install dependencies before sonar-scanner setup. Update build wrapper output directory path to match project structure. Improve C++ code quality by replacing C-style cast with modern static_cast in ssllabs.cpp.
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the SonarQube build wrapper output path and refactors a pointer cast in the SSL Labs source code to use a modern C++ static cast. Feedback highlights a potential buffer over-read in the CURL write callback, suggesting the use of the buffer size during string appending, and recommends transitioning to a compilation database for more robust SonarQube analysis.
| size_t realsize = size * nmemb; | ||
|
|
||
| std::string *mem = (std::string *) up; | ||
| auto *mem = static_cast<std::string *>(up); |
There was a problem hiding this comment.
While refactoring the cast, note that the subsequent mem->append(buf) is unsafe. CURL's buffer is not null-terminated and may contain null bytes. Use mem->append(buf, realsize) instead to prevent buffer over-reads and ensure all data is correctly captured.
|
|
||
| # Use this if you have a specific build tool (optional) | ||
| sonar.cfamily.build-wrapper-output=build_wrapper_output_directory | ||
| sonar.cfamily.build-wrapper-output=build/wrapper_output_directory |
There was a problem hiding this comment.
For CMake projects, using a compilation database (compile_commands.json) is preferred over the build-wrapper. It's more robust and easier to maintain. You can enable it with -DCMAKE_EXPORT_COMPILE_COMMANDS=ON and then uncomment and set sonar.cfamily.compile-commands=build/compile_commands.json.
1 participant
Update sonar-scanner setup to build from source instead of
downloading prebuilt binaries. This requires installing additional
dependencies including maven and cmake.
Reorganize workflow steps to install dependencies before sonar-scanner
setup. Update build wrapper output directory path to match project
structure.
Improve C++ code quality by replacing C-style cast with modern
static_cast in ssllabs.cpp.