From 402d7501388e2c0965e33123b3939a35bac83f46 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Mon, 20 Jul 2026 23:20:35 -0500
Subject: [PATCH] ci(sonarqube): add non-blocking SonarQube analysis on push to
 main

Mirrors the website repo's setup: a source-based scan of app/src/main
(Kotlin) that reports to the self-hosted SonarQube server after merge,
never gating PRs.

Uses the existing SonarQube project key Runic-Gateway-Android-app (the
server rejects re-creating a case-variant key). Supersedes #18.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .gitea/workflows/sonarqube.yml | 54 ++++++++++++++++++++++++++++++++++
 sonar-project.properties       | 32 ++++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 .gitea/workflows/sonarqube.yml
 create mode 100644 sonar-project.properties

diff --git a/.gitea/workflows/sonarqube.yml b/.gitea/workflows/sonarqube.yml
new file mode 100644
index 0000000..756f2b4
--- /dev/null
+++ b/.gitea/workflows/sonarqube.yml
@@ -0,0 +1,54 @@
+# Run SonarQube static analysis against the code that just landed on `main` and
+# report the results to the self-hosted SonarQube server for review. This is
+# intentionally NON-BLOCKING: it triggers on push to main (i.e. AFTER merge),
+# not on pull_request, so it never gates a PR. It complements pr-checks.yml
+# (which gates PRs) and release.yml (which ships the APK) — this one only feeds
+# the dashboard.
+#
+# Prerequisites (one-time, in the Gitea UI — Repo → Settings → Actions):
+#   • Secret   SONAR_TOKEN     — a SonarQube "Analysis" token generated at
+#                                My Account → Security in SonarQube for the
+#                                Runic-Gateway-Android-app project (or a global one).
+#   • Variable SONAR_HOST_URL  — the SonarQube base URL on your LAN, e.g.
+#                                http://192.168.0.56:9000
+#     (kept as a variable, not committed, so the internal address stays out of git.)
+#
+# The runner (self-hosted `ubuntu-latest`, same as the other workflows) must be
+# able to reach SONAR_HOST_URL on your network. Nothing here waits on the
+# SonarQube Quality Gate, so a failing gate does not fail this job — check the
+# dashboard when you want to.
+#
+# Scope: this analyses the Kotlin source directly (the Sonar scanner reads
+# sonar-project.properties). It does NOT run a Gradle build, so no Android SDK /
+# JDK install is needed — the Kotlin analyzer is source-based. See the "Optional
+# enrichment" note in sonar-project.properties for wiring in Android Lint /
+# coverage reports later.
+
+name: SonarQube
+
+on:
+  push:
+    branches: [main]
+  # Allow re-running the analysis on demand from the Actions tab.
+  workflow_dispatch: {}
+
+concurrency:
+  group: sonarqube-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out (full history for accurate new-code + blame)
+        uses: actions/checkout@v4
+        with:
+          # SonarQube uses git history to attribute issues to authors and to
+          # compute "new code". A shallow clone degrades both.
+          fetch-depth: 0
+
+      - name: Run SonarQube scan
+        uses: sonarsource/sonarqube-scan-action@v4
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..8b91d73
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,32 @@
+# SonarQube analysis config for the Android-app repo.
+# Consumed by the scanner in .gitea/workflows/sonarqube.yml on push to main.
+# The project key must match the one created in SonarQube (dashboard URL
+# ?id=Runic-Gateway-Android-app).
+
+sonar.projectKey=Runic-Gateway-Android-app
+sonar.projectName=runic gateway android app
+
+# Analysed application code. The single :app module's Kotlin sources.
+# SonarQube's Kotlin analyzer works on source directly, so no compiled classes
+# or Gradle build are required for the scan.
+sonar.sources=app/src/main
+
+# Local unit tests (app/src/test). Instrumented tests (app/src/androidTest) can
+# be added here once that source set exists.
+sonar.tests=app/src/test
+
+# Never analyse build output, Gradle internals, or generated code.
+sonar.exclusions=**/build/**,**/.gradle/**,**/generated/**
+
+sonar.sourceEncoding=UTF-8
+
+# ── Optional enrichment (enable once the reports are produced in CI) ──
+# For richer Kotlin/Android results, run the reporters in sonarqube.yml and point
+# SonarQube at their output:
+#   • Android Lint:  ./gradlew lintDebug   → app/build/reports/lint-results-debug.xml
+#     sonar.androidLint.reportPaths=app/build/reports/lint-results-debug.xml
+#   • JaCoCo coverage (needs a coverage-enabled test run):
+#     sonar.coverage.jacoco.xmlReportPaths=app/build/reports/jacoco/.../*.xml
+# The alternative to the CLI scanner used here is the SonarQube Gradle plugin
+# (org.sonarqube), which auto-discovers these reports; the CLI + properties file
+# is used instead to keep this repo's setup identical to website/ and link/.