sonarcloud.yml

name: SonarCloud Analysis
on:
  push:
    branches:
      - master
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
jobs:
  sonarcloud:
    if: ${{ !github.event.repository.private }}
    name: SonarCloud
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
        with:
          fetch-depth: 0
      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: '3.11'
      - name: Install dependencies
        run: uv sync --frozen
      - name: Run tests with coverage
        continue-on-error: true
        run: uv run pytest --cov=. --cov-report=xml --cov-report=term-missing || true
      - name: Check for SonarCloud token
        id: check-sonar
        run: |
          if [ -n "${{ secrets.SONAR_TOKEN }}" ]; then
            echo "has_token=true" >> $GITHUB_OUTPUT
          else
            echo "has_token=false" >> $GITHUB_OUTPUT
            echo "::notice::SONAR_TOKEN not configured — skipping SonarCloud scan"
          fi
      - name: SonarCloud Scan
        if: steps.check-sonar.outputs.has_token == 'true'
        uses: SonarSource/sonarcloud-github-action@ffc3010689be73b8e5ae0c57ce35968afd7909e8  # v5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}