sonar-scan.yml

name: SonarQube Scan

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  wait_for_workflows:
    name: Wait for workflows
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Checkout Repository
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}

      - name: Wait for workflows
        uses: smartcontractkit/chainlink-github-actions/utils/wait-for-workflows@e29366cdecfe6befff9ab8c3cfe4825218505d58 # v2.3.16
        with:
          max-timeout: "900"
          polling-interval: "30"
          exclude-workflow-names: "CD Release, Dependency Vulnerability Check"
          exclude-workflow-ids: ""
          github-token: ${{ secrets.GITHUB_TOKEN }}
        env:
          DEBUG: "true"

  sonarqube:
    name: SonarQube Scan
    needs: [wait_for_workflows]
    runs-on: ubuntu-latest
    permissions:
      actions: read
    if: always()
    steps:
      - name: Checkout the repo
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          fetch-depth: 0 # fetches all history for all tags and branches to provide more metadata for sonar reports

      - name: Download Golangci-lint report
        if: always()
        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
        with:
          workflow: ci-lint.yml
          name: golangci-lint-report
          workflow_conclusion: ""
          if_no_artifact_found: warn

      - name: Download go unit test coverage reports
        if: always()
        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
        with:
          workflow: ci-test.yml
          name: go-test-results
          workflow_conclusion: ""
          if_no_artifact_found: warn

      - name: Set SonarQube Report Paths
        if: always()
        id: sonarqube_report_paths
        shell: bash
        run: |
          echo "sonarqube_go_coverage_report_paths=$(find -type f -name '*coverage.txt' -printf '%p,')" >> $GITHUB_OUTPUT
          echo "sonarqube_golangci_report_paths=$(find -type f -name 'golangci-lint-report.xml' -printf '%p,')" >> $GITHUB_OUTPUT

      - name: SonarQube Scan
        if: always()
        uses: sonarsource/sonarqube-scan-action@53c3e3207fe4b8d52e2f1ac9d6eb1d2506f626c0 # v2.0.2
        with:
          args: >
            -Dsonar.go.coverage.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_go_coverage_report_paths }}
            -Dsonar.go.golangci-lint.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_golangci_report_paths }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}