SonarQube Quality Gate Audit and AI Code Triage

id: sonarqube-quality-gate-ai-triage
namespace: company.team
description: |
  Trigger a SonarQube code quality and security scan on a repository, evaluate Quality Gate status,
  and automatically use AI to triage code smells, vulnerabilities, or bugs to Slack and GitHub.

triggers:
  - id: on_code_push_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    description: Triggered when a PR or commit is pushed to the repository.
    key: "{{ secret('SONARQUBE_WEBHOOK_KEY') }}"

inputs:
  - id: repository
    type: STRING
    defaults: your-org/your-repo
    displayName: Repository
    description: Target repository name in owner/repo format.
  - id: branch
    type: STRING
    defaults: main
    displayName: Branch
    description: Branch to scan with SonarQube.
  - id: project_key
    type: STRING
    defaults: my-project-key
    displayName: SonarQube Project Key
    description: Project key registered in your SonarQube instance.

tasks:
  - id: workspace
    type: io.kestra.plugin.core.flow.WorkingDirectory
    description: Shared working directory for repository checkout and SonarScanner
      execution.
    tasks:
      - id: clone_repository
        type: io.kestra.plugin.git.Clone
        description: Check out the target codebase.
        url: "https://github.com/{{ inputs.repository }}.git"
        username: x-access-token
        password: "{{ secret('GITHUB_TOKEN') }}"
        branch: "{{ inputs.branch }}"

      - id: run_sonar_scanner
        type: io.kestra.plugin.scripts.shell.Commands
        description: Run official SonarScanner container to analyze code quality and
          push metrics to SonarQube server.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: sonarsource/sonar-scanner-cli:latest
        env:
          SONAR_HOST_URL: "{{ secret('SONAR_HOST_URL') }}"
          SONAR_TOKEN: "{{ secret('SONAR_TOKEN') }}"
        commands:
          - sonar-scanner -Dsonar.projectKey={{ inputs.project_key }}
            -Dsonar.sources=. -Dsonar.host.url=$SONAR_HOST_URL
            -Dsonar.token=$SONAR_TOKEN || true

      - id: fetch_quality_gate_status
        type: io.kestra.plugin.scripts.python.Script
        description: Fetch SonarQube Quality Gate status and issue breakdown via HTTP
          REST API.
        taskRunner:
          type: io.kestra.plugin.core.runner.Process
        env:
          SONAR_HOST_URL: "{{ secret('SONAR_HOST_URL') }}"
          SONAR_TOKEN: "{{ secret('SONAR_TOKEN') }}"
        script: |
          import json
          import os
          import urllib.request
          import base64

          host_url = os.environ.get("SONAR_HOST_URL", "http://localhost:9000").rstrip("/")
          token = os.environ.get("SONAR_TOKEN", "")
          project_key = "{{ inputs.project_key }}"

          # Fetch Quality Gate status
          auth_header = base64.b64encode(f"{token}:".encode('utf-8')).decode('utf-8')
          req = urllib.request.Request(
              f"{host_url}/api/qualitygates/project_status?projectKey={project_key}",
              headers={"Authorization": f"Basic {auth_header}"}
          )

          quality_gate_status = "UNKNOWN"
          failed_conditions = []

          try:
              with urllib.request.urlopen(req) as response:
                  res_data = json.loads(response.read().decode())
                  project_status = res_data.get("projectStatus", {})
                  quality_gate_status = project_status.get("status", "UNKNOWN")
                  failed_conditions = [c for c in project_status.get("conditions", []) if c.get("status") == "ERROR"]
          except Exception as e:
              print(f"Error fetching quality gate status: {e}")
              quality_gate_status = "ERROR"
              failed_conditions = [{"metricKey": "quality_gate", "actualValue": "FAILED", "errorThreshold": "OK"}]

          is_failed = quality_gate_status == "ERROR" or len(failed_conditions) > 0

          print(f"SonarQube Quality Gate Status: {quality_gate_status}")
          print(f"Failed Conditions Count: {len(failed_conditions)}")

          print("::" + json.dumps({"outputs": {
              "status": quality_gate_status,
              "is_failed": is_failed,
              "failed_conditions": json.dumps(failed_conditions)
          }}) + "::")

  - id: evaluate_quality_gate
    type: io.kestra.plugin.core.flow.If
    description: Branch execution depending on whether SonarQube Quality Gate passed
      or failed.
    condition: "{{ outputs.fetch_quality_gate_status.vars.is_failed }}"
    then:
      - id: ai_code_quality_triage
        type: io.kestra.plugin.ai.agent.AIAgent
        description: Use AI agent to analyze failed SonarQube quality gate conditions
          and recommend code fixes.
        provider:
          type: io.kestra.plugin.ai.provider.GoogleGemini
          apiKey: "{{ secret('GEMINI_API_KEY') }}"
          modelName: gemini-2.5-flash
        systemMessage: |
          You are a Senior Software Quality Engineer. Analyze SonarQube quality gate failures
          (coverage breaches, security hotspots, code smells, cognitive complexity, or vulnerabilities)
          and provide actionable refactoring and fix recommendations.
        prompt: |
          Repository: {{ inputs.repository }}
          Branch: {{ inputs.branch }}
          SonarQube Project: {{ inputs.project_key }}
          Quality Gate Failed Conditions:
          {{ outputs.fetch_quality_gate_status.vars.failed_conditions }}

      - id: post_github_quality_issue
        type: io.kestra.plugin.github.issues.Create
        description: Open a GitHub issue with the Quality Gate failure breakdown and AI
          triage plan.
        jwtToken: "{{ secret('GITHUB_TOKEN') }}"
        repository: "{{ inputs.repository }}"
        title: "❌ SonarQube Quality Gate Failed for {{ inputs.repository }} ({{
          inputs.branch }})"
        body: |
          ## 🔍 SonarQube Quality Gate Failure Report

          **Project Key:** `{{ inputs.project_key }}`
          **Branch:** `{{ inputs.branch }}`
          **Status:** `FAILED`

          ### Failed Quality Gate Conditions
          `{{ outputs.fetch_quality_gate_status.vars.failed_conditions }}`

          ### 💡 AI Code Improvement Recommendations
          {{ outputs.ai_code_quality_triage.textOutput }}

          ---
          *Automated by Kestra execution `{{ execution.id }}`*
        labels:
          - code-quality
          - sonarqube
          - tech-debt

      - id: notify_slack_quality_failure
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Alert dev team on Slack about SonarQube Quality Gate failure.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "❌ *SonarQube Quality Gate FAILED*\nRepository: `{{ inputs.repository }}` (Branch: `{{ inputs.branch }}`)\nProject: `{{ inputs.project_key }}`\nGitHub issue created with AI refactoring recommendations."
          }

    else:
      - id: log_quality_gate_passed
        type: io.kestra.plugin.core.log.Log
        message: "✅ SonarQube Quality Gate PASSED for {{ inputs.repository }} (Branch:
          {{ inputs.branch }})."