Branch: refs/heads/misc-sonar-pr-workflow Home: https://github.com/xwiki/xwiki-commons Commit: 42d0bde42ada8da83eb2d2e93098b873fdfc5c29 https://github.com/xwiki/xwiki-commons/commit/42d0bde42ada8da83eb2d2e93098b8... Author: Vincent Massol <[email protected]> Date: 2026-08-27 (Thu, 27 Aug 2026) Changed paths: A .github/workflows/sonar-pr.yml Log Message: ----------- [Misc] Analyze pull requests with SonarCloud and fail on their quality gate * Add a GitHub Actions workflow that compiles the reactor without the tests and runs a SonarCloud pull request analysis, with sonar.qualitygate.wait so that the job fails when the pull request's quality gate fails. Catches a change introducing SonarQube issues before it is merged, instead of after it has turned the master quality gate red. * Pass the pull request properties through the environment instead of interpolating them into the command, so that a crafted branch name cannot run commands on the runner, and restrict the job to reading the repository contents. * Requires a SONAR_TOKEN repository or organization secret. Pull requests from forks get no secrets and are skipped. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-commons/settings/notifications