sonarqube.yml

name: SonarQube Code Quality

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]
  workflow_dispatch:

concurrency:
  group: sonarqube-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sonarqube:
    name: Scan & enforce Quality Gate
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout (full history for accurate blame)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # -------------------------------------------------------------------
      # Backend (Python) — produce coverage.xml for Sonar
      # -------------------------------------------------------------------
      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install backend deps + coverage tools
        working-directory: backend
        run: |
          python -m pip install --upgrade pip
          pip install -e .
          pip install coverage pytest pytest-cov

      - name: Run backend tests with coverage
        working-directory: backend
        env:
          SKIP_LOCAL_OLLAMA: "1"
          SKIP_CLOUD: "1"
        run: |
          pytest \
            --cov=app \
            --cov-report=xml:coverage.xml \
            --junitxml=pytest-report.xml \
            tests || true   # don't fail the job here; Quality Gate decides

      # -------------------------------------------------------------------
      # Frontend (Next.js / TS) — produce lcov.info for Sonar
      # -------------------------------------------------------------------
      - name: Set up Node 20
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install frontend deps
        working-directory: frontend
        run: npm ci || npm install

      # If/when you add Jest/Vitest, uncomment to emit coverage:
      # - name: Run frontend tests with coverage
      #   working-directory: frontend
      #   run: npx vitest run --coverage --coverage.reporter=lcov

      # -------------------------------------------------------------------
      # SonarQube scan — uploads analysis AND waits for the Quality Gate
      # in a single step (-Dsonar.qualitygate.wait=true). The job fails
      # red when the gate is not passed.
      # -------------------------------------------------------------------
      - name: SonarQube Scan & Quality Gate
        uses: SonarSource/sonarqube-scan-action@v4
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        with:
          args: >
            -Dsonar.qualitygate.wait=true
            -Dsonar.qualitygate.timeout=300