sonarcloud.yml

name: SonarCloud
on:
  push:
    branches:
      - master
  pull_request:
    types:
      - opened
      - synchronize
      - reopened

permissions:
  contents: read

jobs:
  build:
    name: Build and analyze
    runs-on: ubuntu-latest
    env:
      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: block
          allowed-endpoints:
            analysis-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
            api.github.com:443
            api.nuget.org:443
            api.sonarcloud.io:443
            azure.archive.ubuntu.com:80
            binaries.sonarsource.com:443
            esm.ubuntu.com:443
            github.com:443
            motd.ubuntu.com:443
            packages.microsoft.com:443
            scanner.sonarcloud.io:443
            sonarcloud.io:443

      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Install dependencies
        uses: ./.github/actions/install-dependencies

      - name: Generate compilation database
        run: cmake -B build

      - name: Run sonar-scanner
        uses: SonarSource/sonarqube-scan-action@bfd4e558cda28cda6b5defafb9232d191be8c203 # v4.2.1
        with:
          args: --define sonar.cfamily.compile-commands=build/compile_commands.json
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}