Question: Publishing sonar-cxx artifacts to Maven Central or GitHub Packages?

[chmodshubham]

Hi maintainers,

Unlike official SonarSource language plugins, sonar-cxx artifacts (like cxx-squid and cxx-squid-bridge) are not published to the Maven Central Repository due to which one has to manually download the "fat jar" from the GitHub Releases page, extract the inner jars, and install them into the local Maven cache.

1. Is there a specific reason why sonar-cxx isn't published to Maven Central?

• I assume this might be related to it being a community-edition plugin not officially maintained by SonarSource?

2. Would it be possible to publish the artifacts to GitHub Packages?

• If Maven Central is not possible to publish to, could the project's GitHub Actions release workflow push the artifacts to the GitHub Packages registry?

Publishing to either registry would massively simplify the build process and dependency management.

Are there any existing plans to support this, or is this something the project would be open to trying? I'd be happy to work upon this if it's something the maintainers are open to!

Thank you!

[guwirth]

Hi @chmodshubham,

Is there a specific reason why sonar-cxx isn't published to Maven Central?

Simple reason is that no one was asking for this up to now.

build process and dependency management

For what exactly do you need that? What is your use case?
All others are using the plug-in as is.

Regards,

[chmodshubham]

Hi @guwirth,

I'm working with sonar-cryptography - a sonarqube plugin, which depends on sonar-cxx to parse C/C++ source files. Manually downloading the .jar file, extracting the inner jars, and installing them into the local maven is not a big task (can be done through some automation), but the issue is that sonar-cryptography doesn't work standalone. It is further consumed by cbomkit-lib which is in turn consumed by cbomkit and cbomkit-action (you can find their repos here) and sonar-cryptography dependencies (e.g. sonar-java, sonar-python, sonar-cxx, etc) are used as transitive dependencies for cbomkit-lib.

So, for this to work, I've to look for some workaround. But if the sonar-cxx artifacts are published to a registry (maven or gh pkgs), then it will be easy to automate this dependency chain.

[amai2012]

see https://docs.github.com/en/actions/tutorials/publish-packages/publish-java-packages-with-maven

[guwirth]

Hi @chmodshubham,

this would add one more dependencies to the build (maven repository, user, token, …) and effort to maintain everything. I don’t wanna do it.

Regards,

[chmodshubham]

Hi @guwirth,

I understand the effort and maintenance one needs to put into publishing the artifact to the central Maven is quite high, and that's why I also suggest that publishing to gh-packages can be an option. Unlike publishing to central Maven, publishing to gh-packages is quite simple and doesn't require much maintenance (no user, token, or similar dependencies).

Here is a simple example of a workflow - https://github.com/chmodshubham/sonar-cxx/blob/gh-pkg/.github/workflows/publish.yml. Only one change is needed, instead of publishing on every merge, it should be triggered on every release, and thats it.

See, if you find this solution worth it, and as I said earlier, I can do the work on this.

Please let me know your view.

Thanks,
Shubham