ci: add SonarQube Cloud static analysis and coverage tracking#52
Merged
Conversation
Apply the org.sonarqube Gradle plugin at the root for multi-module aggregation, consuming the per-module JaCoCo XML already produced by pkauth.test-conventions. A dedicated `sonar` CI job runs the build and submits coverage + analysis, gated to pushes and same-repo PRs (fork PRs can't read SONAR_TOKEN) with fetch-depth: 0 for SCM blame. The sonar task is not configuration-cache compatible, so CI invokes it with --no-configuration-cache (the config cache stays on globally). Adds ADR 0017 documenting the decision and Quality Gate + Coverage badges to the README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
wolpert
enabled auto-merge (rebase)
June 11, 2026 13:58
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Wires the project into SonarQube Cloud (free open-source tier) for coverage trends, code smells, security hotspots, and duplication tracking — complementing the existing per-module JaCoCo floors and Stryker mutation testing.
Changes
gradle/libs.versions.toml— add theorg.sonarqubeplugin (7.3.1.8318) to the version catalog.build.gradle.kts(root) — apply the plugin and add asonar { }block (project keycodeheadsystems_pk-auth, orgcodeheadsystems, hostsonarcloud.io, excludingexamples/**and the generated browser SDKdist/). Coverage is auto-detected from the JaCoCo XML already produced bypkauth.test-conventions— no new plumbing..github/workflows/ci.yml— newsonarjob running./gradlew build jacocoTestReport sonar --no-configuration-cache, withfetch-depth: 0and a fork-PR guard (forks can't readSONAR_TOKEN).docs/adr/0017-...— ADR documenting the decision, options considered, and consequences.README.md— Quality Gate + Coverage badges.Notes
sonartask is not Gradle configuration-cache compatible (the config cache is on globally), so CI invokes it with--no-configuration-cache— a scoped exception, documented in the ADR.SONAR_TOKENrepo secret) is already done. If the imported project key differs fromcodeheadsystems_pk-auth, update the twoproperty(...)lines inbuild.gradle.ktsand the badge URLs.:sonartask registers.🤖 Generated with Claude Code