Move sonarcloud checks to test job

.github/workflows/golang.yaml

@@ -1,3 +1,4 @@
+
 # Copyright 2024 Zaphiro Technologies
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -38,6 +39,11 @@ on:
         default: false
         type: boolean
         description: True to skip benchmark exec
+      code-scan:
+          required: false
+          default: true
+          type: boolean
+          description: False to skip code-scan exec
       vulterability-scan:
         required: false
         default: true
@@ -89,6 +95,8 @@ jobs:
       GH_ACCESS_TOKEN: ${{ secrets.REPO_PRIVATE_READ_PAT }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - run: git config --global url.https://[email protected]/.insteadOf https://github.com/
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -109,6 +117,20 @@ jobs:
       - name: Test
         run: |
           make ci-test
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ inputs.code-scan }}
+        # we log in the registry to code check also images
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: SonarCloud Code Scan
+        if: ${{ inputs.code-scan }}
+        uses: SonarSource/sonarcloud-github-action@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
       - name: Download code coverage report from base branch
         uses: dawidd6/action-download-artifact@v3
         if: github.actor != 'dependabot[bot]'

RELEASE_NOTES.md

@@ -1,12 +1,12 @@
 # GitHub Workflows Release Notes
 
-## 0.0.3-dev - 2024-05-20
+## 0.0.3-dev - 2024-05-21
 
 ### Features
 
-- Add the deployment workflow (PR #115 by @cosimomeli)
 - license, docker, golang, release notes workflows: support SBOM generation,
   license compatibility check and vulnerability check (PR #116 by @chicco785)
+- Add the deployment workflow (PR #115 by @cosimomeli)
 - markdown workflow: Use quiet mode for link checker (PR #112 by @chicco785)
 - golang workflow: add input variable for alert threshold (PR #101 by
   @chicco785)
@@ -19,6 +19,10 @@
 - Support different grammar check modalities (local and online) in the script
   (PR #89 by @chicco785)
 
+### Continuous Integration
+
+- Move sonarcloud checks to test job (PR #119 by @chicco785)
+
 ### Dependencies
 
 - Bump golangci/golangci-lint-action from 5 to 6 (PR #117 by @dependabot[bot])