Black Duck integration and CI/SonarQube updates

[nikhil2611]

This pull request introduces a new GitHub Actions workflow stub for continuous integration (CI) on the main branch and updates the SonarQube project configuration. The main goals are to standardize CI checks using a shared workflow and to enhance SonarQube settings with improved metadata, language targeting, and documentation.

Description

This pull request introduces a new GitHub Actions workflow stub for CI on the main branch and significantly updates the SonarQube configuration. The changes improve CI/CD automation, security, and code quality analysis by centralizing and clarifying workflow parameters and enhancing SonarQube project metadata and settings.

Continuous Integration Workflow Enhancements:

• Added .github/workflows/ci-main-pull-request-stub.yml as a reusable workflow stub to standardize CI checks on pull requests and pushes to main and chef-cli-5 branches, integrating security scans (Trivy, Trufflehog, BlackDuck Polaris), SonarQube analysis, SBOM generation, and more. The stub forwards relevant secrets and parameters to a central workflow and includes detailed documentation for each input.

SonarQube Configuration Improvements:

• Refactored sonar-project.properties to provide clearer documentation, updated the project name to a standardized format (Chef_Chef-Agents_chef-cli), explicitly set the language to Ruby, and specified source (lib) and test (spec) directories. Additional comments guide future configuration for coverage, Rubocop, and SARIF reports.

Related Issue

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.

[github-actions]

Simplecov Report

Covered	Threshold
98.51%	90%

[sonarqube-for-infrastructure-prod]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
2 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud