Configure SonarQube scanning (#71)

* Configure SonarQube scanning

* Upgrade checkout action

    Make it non-shallow for better scan results.

* Pin SonarQube action

* Pin Netlify CLI

* Don't run scripts on install

* Add maintainability badge

Author: textbook

.github/workflows/push.yml

@@ -13,14 +13,19 @@ jobs:
   check:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
+        with:
+          fetch-depth: 0
       - uses: "actions/setup-node@v6"
         with:
           cache: "npm"
           node-version: "24"
       - run: "npm ci"
       - run: "npm run lint"
       - run: "npm run test:cover"
+      - uses: "SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e" # v8.2.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
       - run: "npm run build"
       - uses: "actions/upload-artifact@v7"
         with:
@@ -35,7 +40,7 @@ jobs:
     if: "github.ref == 'refs/heads/main' && github.actor != 'dependabot[bot]'"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "actions/setup-node@v6"
         with:
           cache: "npm"
@@ -45,7 +50,7 @@ jobs:
         with:
           name: "build-output"
           path: "lib/"
-      - run: "npm install --global netlify-cli@latest"
+      - run: "npm install --global netlify-cli@26.1.0"
       - run: "netlify --version"
       - run: "netlify deploy --no-build --prod true"
         env:

.npmrc

@@ -1 +1,2 @@
 engine-strict=true
+ignore-scripts=true

README.md

@@ -1,6 +1,7 @@
 # CYF GitBot
 
 [![Node.js CI][ci-badge]][ci-link]
+[![Maintainability Rating][sonar-badge]][sonar-link]
 
 Integrating GitHub and Slack via Netlify.
 
@@ -85,3 +86,5 @@ The Netlify functions require the following environment variables:
 [github-webhooks]: https://docs.github.com/en/developers/webhooks-and-events/webhooks/about-webhooks
 [netlify-functions]: https://functions.netlify.com/
 [slack-channel]: https://codeyourfuture.slack.com/archives/C03LSS9TNRW
+[sonar-link]: https://sonarcloud.io/summary/new_code?id=CodeYourFuture_gitbot
+[sonar-badge]: https://sonarcloud.io/api/project_badges/measure?project=CodeYourFuture_gitbot&metric=sqale_rating

sonar-project.properties

@@ -0,0 +1,9 @@
+sonar.organization=codeyourfuture
+sonar.projectKey=CodeYourFuture_gitbot
+sonar.projectName=gitbot
+
+sonar.sources=src
+sonar.tests=src
+sonar.test.inclusions=src/**/*.test.ts
+
+sonar.javascript.lcov.reportPaths=./reports/coverage/lcov.info

vite.config.js

@@ -3,7 +3,9 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
 	test: {
 		coverage: {
+			exclude: ["**/*.d.ts"],
 			include: ["src/**"],
+			reporter: ["html", "lcovonly", "text"],
 			reportsDirectory: "reports/coverage",
 		},
 		globals: true,