ci(sonarqube): add non-blocking SonarQube analysis on push to main

Mirrors the website repo's setup: a source-based scan of sidecar/src that
reports to the self-hosted SonarQube server after merge, never gating PRs.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/sonarqube.yml

@@ -0,0 +1,52 @@
+# Run SonarQube static analysis against the code that just landed on `main` and
+# report the results to the self-hosted SonarQube server for review. This is
+# intentionally NON-BLOCKING: it triggers on push to main (i.e. AFTER merge),
+# not on pull_request, so it never gates a PR. It complements release.yml
+# (which builds + cuts releases) — this one only feeds the dashboard.
+#
+# Prerequisites (one-time, in the Gitea UI — Repo → Settings → Actions):
+#   • Secret   SONAR_TOKEN     — a SonarQube "Analysis" token generated at
+#                                My Account → Security in SonarQube for the
+#                                runic-gateway-link project (or a global one).
+#   • Variable SONAR_HOST_URL  — the SonarQube base URL on your LAN, e.g.
+#                                http://192.168.0.56:9000
+#     (kept as a variable, not committed, so the internal address stays out of git.)
+#
+# The runner (self-hosted `ubuntu-latest`, same as release.yml) must be able to
+# reach SONAR_HOST_URL on your network. Nothing here waits on the SonarQube
+# Quality Gate, so a failing gate does not fail this job — check the dashboard
+# when you want to.
+#
+# Scope: this analyses the Rust source directly (the Sonar scanner reads
+# sonar-project.properties). It does NOT build the crate or run Clippy — see the
+# "Optional enrichment" note in sonar-project.properties for wiring in a Clippy
+# report if your SonarQube edition supports Rust lint import.
+
+name: SonarQube
+
+on:
+  push:
+    branches: [main]
+  # Allow re-running the analysis on demand from the Actions tab.
+  workflow_dispatch: {}
+
+concurrency:
+  group: sonarqube-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out (full history for accurate new-code + blame)
+        uses: actions/checkout@v4
+        with:
+          # SonarQube uses git history to attribute issues to authors and to
+          # compute "new code". A shallow clone degrades both.
+          fetch-depth: 0
+
+      - name: Run SonarQube scan
+        uses: sonarsource/sonarqube-scan-action@v4
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}

sonar-project.properties

@@ -0,0 +1,25 @@
+# SonarQube analysis config for the link (uo-link sidecar) repo.
+# Consumed by the scanner in .gitea/workflows/sonarqube.yml on push to main.
+# The project key must match the one created in SonarQube (dashboard URL
+# ?id=runic-gateway-link).
+
+sonar.projectKey=runic-gateway-link
+sonar.projectName=runic gateway link
+
+# Analysed application code. The Rust sidecar crate lives under sidecar/src.
+# Rust unit tests live inline (#[cfg(test)] modules) rather than in a separate
+# tree, so there is no distinct sonar.tests path to declare.
+sonar.sources=sidecar/src
+
+# Never analyse build output, the vendored lockfile, or generated config.
+sonar.exclusions=**/target/**,**/*.lock
+
+sonar.sourceEncoding=UTF-8
+
+# ── Optional enrichment (enable if your SonarQube edition/version supports it) ──
+# SonarQube imports Clippy findings when given a JSON report. To turn this on:
+#   1. In sonarqube.yml, add a step before the scan that runs:
+#        cargo clippy --message-format=json > sidecar/clippy-report.json
+#      (needs the Rust toolchain + `rustup component add clippy` on the runner).
+#   2. Uncomment the line below.
+# sonar.rust.clippy.reportPaths=sidecar/clippy-report.json