sonarcloud.yml

name: Build
on:
  push:
    branches:
      - master
      - dev
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

jobs:
  sonarcloud:
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull-requests: read  # for SonarSource/sonarcloud-github-action to determine which PR to decorate
    name: SonarCloud
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@9f9bba2c7aaf7a55eac26abbac906c3021d211b2 # master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}