.github/workflows/sonar.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: SonarCloud

on:
  pull_request:
  push:
    branches:
      - 'main'

permissions: read-all

# Pull requests cancel superseded runs; pushes get unique groups so none is dropped.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

env:
  MAVEN_OPTS: -Xmx2048m -Xms1024m
  LANG: en_US.utf8
  HAVE_SONARCLOUD_TOKEN: ${{ secrets.SONARCLOUD_TOKEN != '' }}

jobs:
  sonarcloud:
    name: Scan
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.base.repo.fork && !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Detect changes
        id: changes
        uses: ./.github/actions/detect-changes
      - uses: actions/setup-java@v6
        if: steps.changes.outputs.code == 'true'
        with:
          distribution: temurin
          java-version: 21
          cache: 'maven'
      - name: SonarCloud Scan
        if: ${{ steps.changes.outputs.code == 'true' && env.HAVE_SONARCLOUD_TOKEN == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}
        run: ./mvnw -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Pcoverage -DskipAssembly
      - name: SonarCloud Scan -- SKIPPED
        if: ${{ steps.changes.outputs.code == 'true' && env.HAVE_SONARCLOUD_TOKEN != 'true' }}
        run: |
          echo "### SonarCloud not configured" >> $GITHUB_STEP_SUMMARY
          echo "secrets.SONARCLOUD_TOKEN not existing, cannot push coverage checks" >> $GITHUB_STEP_SUMMARY