Add Sonar analysis to repository

[jonas-wielage-sonarsource]

No description provided.

[mstachniuk]

LGTM and please see my comments.

One thing is strange, the build-gradle step tooks 20 minutes, (the 18 minutes the regular build)

https://github.com/SonarSource/cloud-native-gradle-modules/actions/runs/20237588101/job/58096368092?pr=90#step:6:1443

Any idea why is it so slow?

[sonarqube-next]

Quality Gate passed for 'cloud-native-gradle-modules'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[sonarqube-cloud-us]

SonarQube reviewer guide

Important

We are currently testing different models for AI Summary.
Please give us your feedback by filling this form.

Model A:

Summary: Add GitHub Actions caching, SonarQube integration, and shadow scan workflow

Review Focus: The custom Gradle cache key generation using md5sum of multiple files; the new shadow-scan workflow configuration with IRIS analysis; migration from direct Gradle command to SonarSource's build-gradle action with disabled caching.

Start review at: .github/workflows/build.yml. This file contains the core build pipeline changes that affect all builds, including the critical caching strategy and the migration to a standardized build action.

Model B:

Summary: Refactor CI/CD pipelines to use standardized SonarSource build actions with Gradle caching, add shadow scan workflow, and configure root build.gradle with SonarQube plugin.

Review Focus:

• The Gradle caching implementation in build.yml uses MD5 checksums of configuration files as cache keys—verify this approach is performant and handles cache invalidation correctly.
• New shadow-scan.yml workflow runs on schedule and pull requests with 'shadow_scan' label—ensure IRIS analysis configuration and permissions are appropriate for your infrastructure.
• Transition from inline ./gradlew build to standardized SonarSource/ci-github-actions/build-gradle@v1 action with disable-caching: 'true'—confirm this setting aligns with the new explicit caching strategy above.

Start review at: .github/workflows/build.yml. This is the primary CI workflow where the most significant functional changes occur: replacement of direct gradle invocation with a reusable action, introduction of explicit Gradle dependency caching, and integration with Develocity. Understanding these changes is critical to validating the new build pipeline behavior.

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

SonarQube reviewer guide

Important

We are currently testing different models for AI Summary.
Please give us your feedback by filling this form.

Model A:

Summary: Add SonarQube analysis with shadow scans and improve Gradle caching in CI workflows.

Review Focus: The custom Gradle cache key generation logic using MD5 hashing of build files is duplicated across workflows and could be error-prone. Verify the shadow scan configuration correctly targets the three different SonarQube platforms (Next, SQC-EU, SQC-US). Ensure the disable-caching: 'true' flag doesn't conflict with the new Gradle cache setup.

Start review at: .github/workflows/shadow-scan.yml. This is a new workflow that introduces multi-platform SonarQube scanning infrastructure and defines the core scanning strategy for the project.

Model B:

Summary: Refactor CI/CD build process with Gradle caching optimization and add new shadow scan workflow for security analysis.

Review Focus:

• The Gradle caching implementation in build.yml uses MD5 checksums of build files as cache keys—verify the hash computation logic is robust and handles all relevant dependency files
• New shadow-scan.yml workflow includes conditional execution based on PR labels; ensure the label-matching logic aligns with team practices
• The migration from direct ./gradlew build to SonarSource/ci-github-actions/build-gradle@v1 action changes build behavior; confirm all parameters (deploy, develocity, artifactory roles) are correctly configured

Start review at: .github/workflows/build.yml. This is the primary workflow file where the core build process is refactored with caching strategy and action migration, affecting all CI builds.

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jonas-wielage-sonarsource]

@mstachniuk It's not always this slow, the last run took 2m. I don't know why it happens, seems to be flaky / sleeping github runners...