analysis-sonarcloud.yml

name: Code scanning / SonarCloud

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup vcpkg with baseline
        uses: lukka/run-vcpkg@a400452f634fe49e9f18d388aeb1809dcc642136 # v11 (full commit SHA)
        with:
          vcpkgGitCommitId: 8d73531d42c57b8e9f02f4db3f671ca3696eaf7b

      - name: Setup CMake
        uses: lukka/get-cmake@v3.27.0@e00a2d0fc1a9f39f0f18a8082a32db8f9a2baf7c

      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y build-essential ninja-build

      # Safe build only for trusted sources
      - name: Build safely
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        run: |
          cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
          cmake --build build --parallel

      # Skip unsafe build on fork PRs
      - name: Skip unsafe build on fork PR
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
        run: echo "Skipping build on fork PR to avoid executing untrusted code."

      - name: SonarCloud Scan
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: SonarSource/sonarcloud-github-action@v2@4b4d7634dab97dcee0b75763a54a6dc92a9e6bc1
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.projectKey=myproject_key
            -Dsonar.organization=myorganization
            -Dsonar.cfamily.threads=${{ steps.cpu-count.outputs.count }}