build.yml

name: Build

on:
  push:
    branches:
      - sonarqube


jobs:
  build:
    name: Build and analyze
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Install unzip
        run: sudo apt-get install -y unzip

      - name: Set up SonarQube scanner
        run: |
          wget -qO- https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.6.2.2472-linux.zip > sonar-scanner.zip
          unzip sonar-scanner.zip -d /opt/
          export PATH=/opt/sonar-scanner-4.6.2.2472-linux/bin:$PATH

      - uses: jitterbit/get-changed-files@v1
        id: diff
        with:
          format: csv
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Run SonarQube analysis
        env:
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
          SONAR_LOGIN: ${{ secrets.SONARQUBE_TOKEN }}
        run: |
          if [ -z "${{ steps.diff.outputs.modified }}" ]; then
            echo "No modified files to analyze"
          else
            /opt/sonar-scanner-4.6.2.2472-linux/bin/sonar-scanner \
              -Dsonar.projectKey=my_project_key \
              -Dsonar.sources=. \
              -Dsonar.inclusions=${{ steps.diff.outputs.modified }}
          fi

#      - uses: actions/checkout@v4
#        with:
#          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
#      - uses: sonarsource/sonarqube-scan-action@master
#        env:
#          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
#          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
#      # If you wish to fail your job when the Quality Gate is red, uncomment the
#      # following lines. This would typically be used to fail a deployment.
#      # - uses: sonarsource/sonarqube-quality-gate-action@master
#      #   timeout-minutes: 5
#      #   env:
#      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}