sonar.yml

name: "sonar"
on:
  push:
    branches:
      - main
  # See https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target for security implications.
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          fetch-depth: 0

      - name: Get info
        id: info
        run: |
          echo "repo_name=$(echo "$GITHUB_REPOSITORY"| cut -d / -f 2)" >> "$GITHUB_OUTPUT"
          echo "repo_owner=$(echo "$GITHUB_REPOSITORY"| cut -d / -f 1)" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
        with:
          node-version: 20
      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Run all checks and build
        run: yarn run all

      - name: SonarCloud Scan
        uses: sonarsource/sonarcloud-github-action@eb211723266fe8e83102bac7361f0a05c3ac1d1b # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.organization=${{ steps.info.outputs.repo_owner }}
            -Dsonar.projectKey=${{ steps.info.outputs.repo_name }}