sonarcloud.yml

# Analyzes the code base using SonarCloud. See
# https://sonarcloud.io/project/overview?id=PicnicSupermarket_error-prone-support.
name: SonarCloud analysis
on:
  pull_request:
  push:
    branches: [ master ]
  schedule:
    - cron: '0 4 * * 1'
permissions:
  contents: read
jobs:
  analyze:
    # Analysis of code in forked repositories is skipped, as such workflow runs
    # do not have access to the requisite secrets.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    steps:
      - name: Install Harden-Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            analysis-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
            api.adoptium.net:443
            api.nuget.org:443
            ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443
            github.com:443
            objects.githubusercontent.com:443
            repo.maven.apache.org:443
            sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
            *.sonarcloud.io:443
            sonarcloud.io:443
      - name: Check out code and set up JDK and Maven
        uses: s4u/setup-maven-action@382542f77617f34e56bf83868920a4d45b7451e7 # v1.16.0
        with:
          checkout-fetch-depth: 0
          java-version: 17.0.13
          java-distribution: temurin
          maven-version: 3.9.9
      - name: Create missing `test` directory
        # XXX: Drop this step in favour of actually having a test.
        run: mkdir refaster-compiler/src/test
      - name: Perform SonarCloud analysis
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: mvn -T1C jacoco:prepare-agent verify jacoco:report sonar:sonar -Dverification.skip -Dsonar.projectKey=PicnicSupermarket_error-prone-support