sonar.yml

name: "sonar"
on:
  push:
    branches:
      - main
  # See https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target for security implications.
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      - name: Get info
        id: info
        run: |
          echo "repo_name=$(echo "$GITHUB_REPOSITORY"| cut -d / -f 2)" >> "$GITHUB_OUTPUT"
          echo "repo_owner=$(echo "$GITHUB_REPOSITORY"| cut -d / -f 1)" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 20
      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Run all checks and build
        run: yarn run all

      - name: SonarCloud Scan
        uses: sonarsource/sonarcloud-github-action@e44258b109568baa0df60ed515909fc6c72cba92 # v2.3.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.organization=${{ steps.info.outputs.repo_owner }}
            -Dsonar.projectKey=${{ steps.info.outputs.repo_name }}