indigo-iam / esaco Goto Github PK

The current approach relies on a fixed model object, while ESACO should be flexible enough to allow the validation of required claims and expose any other claim returned by the upstream introspection endpoint.

We should migrate away from our on-premise sonar instance and use sonarcloud for sonar analysis, which is free for open source projects.

IAM already does this, see the Jenkinsfile.

Acceptance:

• ESACO static analysis is run on Sonarcloud.io instead of our own sonarqube server
• Members of the indigo-iam organization have access to the reports

https://github.com/GoogleContainerTools/jib

Esaco returns claims in camelCase, while snakeCase should be enforced

Which at the time of this writing is 2.2.5