mag/SonarDesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated deployer code

Browse Source
This commit is contained in:
Mark Gregory
2026-09-29 16:55:12 +01:00
parent c0bc265ade
commit e8b0a1ce57
11 changed files with 470 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/README.md
+63
View File
@@ -0,0 +1,63 @@
# SonarDesk
Native macOS SonarQube dashboard built with SwiftUI.
## Open
Open `SonarDesk.xcodeproj` in Xcode, select your Development Team under Signing & Capabilities, then Run.
## First connection
Open SonarDesk > Settings, add your SonarQube Server URL and a SonarQube user token. Tokens are stored in Keychain.
## Included
- Multiple SonarQube servers
- Keychain token storage
- Server status/version
- Project dashboard
- Quality gate state
- Bugs, vulnerabilities, smells, coverage, duplication, LOC
- Project detail
- Unresolved issue browser/search
- Sandboxed outgoing networking
## v1.2 dashboard improvements
- Colour-accented interactive dashboard cards.
- Bugs and Vulnerabilities cards navigate directly to filtered global issues.
- Failed Gates card filters the dashboard project list to failing quality gates.
- Projects card restores the complete project list.
- Dashboard project rows are clickable and open project details.
- Dashboard project pagination with 10, 25, and 50 rows per page.
- Existing user-defined sidebar project ordering is preserved by pagination.
## v1.3
- Server-side pagination for All Issues, Bugs, Vulnerabilities and Code Smells (25/50/100 rows).
- Dedicated issue destinations in the main sidebar.
- Project metric navigation replaces the old View label/buttons; every metric card has a destination.
- Professional semantic colour system across dashboard/project metrics.
- New SonarDesk application icon and branded launch splash.
## v2.0.2 branding fix
- AppIcon is explicitly selected by the target and `CFBundleIconName`.
- SonarDeskLogo is bundled as a normal image asset and applied to `NSApplication.applicationIconImage` at launch, including development runs.
- Startup now begins on a dedicated branded launch view for at least 1.6 seconds while the initial SonarQube refresh runs, then transitions into the main UI.
## v2.1.0 — Direct distribution hardening
- Hardened Runtime explicitly enabled for Debug and Release.
- App Sandbox retained with only outbound network access.
- No hardened-runtime exception entitlements (no JIT, unsigned executable memory, DYLD injection, or disabled library validation).
- Release builds do not inject Xcode debug entitlements.
- SonarQube tokens remain in Keychain and are marked ThisDeviceOnly.
- Networking uses an ephemeral URLSession with no URL cache or cookie store.
- Production SonarQube endpoints must use HTTPS; plain HTTP is limited to localhost development.
- Server error response bodies are not surfaced to the UI.
- `Distribution/ExportOptions.plist` is included for Developer ID export.
- `Distribution/notarize.sh` verifies signing, submits with `notarytool`, staples the ticket, and runs Gatekeeper assessment.
### Direct release workflow
1. In Xcode, set your Apple Developer Team and ensure a **Developer ID Application** certificate is available.
2. Product > Archive.
3. Organizer > Distribute App > Developer ID / Direct Distribution and export the signed app.
4. Store notarization credentials once, for example:
`xcrun notarytool store-credentials SonarDesk-Notary --apple-id YOUR_APPLE_ID --team-id YOUR_TEAM_ID --password YOUR_APP_SPECIFIC_PASSWORD`
5. Run: `NOTARY_PROFILE=SonarDesk-Notary ./Distribution/notarize.sh /path/to/SonarDesk.app`
6. Distribute the stapled app in a DMG/ZIP. Do not re-sign or modify the app after notarization.
Before every release, test the exported build on a clean macOS user account and run `codesign --verify --deep --strict`, `spctl --assess --type execute`, and `xcrun stapler validate`.
docs/RELEASE-HARDENING.md
+26
View File
@@ -0,0 +1,26 @@
# SonarDesk 2.2 Release Hardening
This build hardens the existing 2.1 iCloud-enabled application without changing its storage layout.
## Implemented
- Hardened Runtime and App Sandbox remain enabled for Release.
- Release uses whole-module optimisation and product validation.
- iCloud Drive JSON writes are file-coordinated and atomic.
- Existing iCloud data files receive rolling backups in `Backups` (last 10 per data file).
- iCloud reads detect files that are not downloaded instead of silently treating them as missing.
- Report writes are coordinated and atomic; corrupt reports are preserved and reported rather than silently discarded.
- Report deletion now surfaces filesystem errors.
- SonarQube GET requests retry transient transport, 429, and 5xx failures with bounded backoff.
- Authentication failures have a specific user-facing error.
- Server URLs are normalised and reject credentials/query/fragment data.
- Duplicate SonarQube server URLs are rejected.
- Tokens remain in synchronisable Keychain and never enter iCloud Drive JSON.
- Version bumped to 2.2.0 (build 6).
## Required on the release Mac
A final archive still has to be compiled with Apple Xcode because this environment does not contain the macOS SDK/Xcode. Before distribution:
1. Select the correct Apple Developer Team and confirm `iCloud.net.absdev.SonarDesk` is enabled for the App ID.
2. Build the Release configuration with zero compiler errors.
3. Archive with Developer ID Application signing.
4. Notarize the archive and staple the notarization ticket.
5. Test the signed/notarized build from a clean user account or second Mac, including iCloud Drive, Keychain, server add/edit/delete, reports, offline launch, and reconnect.