fix: torna delete-branch seguro para forks e ajusta security-summary

- Adiciona guarda para nao executar em PRs de fork

- Tolerancia a branch ja removida ou inexistente

- Inclui sonarqube no security-summary

Co-Authored-By: Afonso Dutra Nogueira Filho <afonsoft@gmail.com>

Author: devin-ai-integration[bot]

.github/workflows/delete-branch-on-merge.yml

@@ -9,7 +9,9 @@ jobs:
   delete-merged-branch:
     name: 🗑️ Delete merged branch
     runs-on: ubuntu-latest
-    if: github.event.pull_request.merged == true
+    if: |
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write
 
@@ -32,5 +34,6 @@ jobs:
           esac
 
           echo "🗑️ Deleting merged branch: $BRANCH_NAME"
-          gh api "repos/${{ github.repository }}/git/refs/heads/${BRANCH_NAME}" --method DELETE
-          echo "✅ Branch '$BRANCH_NAME' deleted successfully."
+          gh api "repos/${{ github.repository }}/git/refs/heads/${BRANCH_NAME}" --method DELETE \
+            || echo "⚠️ Could not delete branch '$BRANCH_NAME' (already removed or from a fork)."
+          echo "✅ Branch '$BRANCH_NAME' cleanup completed."

.github/workflows/security-scan.yml

@@ -152,7 +152,7 @@ jobs:
   security-summary:
     name: 📋 Security Summary
     runs-on: ubuntu-latest
-    needs: [codeql, snyk]
+    needs: [codeql, snyk, sonarqube]
     if: always()
 
     steps:
@@ -164,17 +164,17 @@ jobs:
           echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
           echo "| 🔍 CodeQL | ${{ needs.codeql.result }} |" >> $GITHUB_STEP_SUMMARY
           echo "| 🛡️ Snyk | ${{ needs.snyk.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| 📊 SonarQube | ${{ contains(needs.*.result, 'skipped') && 'skipped' || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| 📊 SonarQube | ${{ needs.sonarqube.result }} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          if [[ "${{ needs.codeql.result }}" == "failure" || "${{ needs.snyk.result }}" == "failure" ]]; then
+          if [[ "${{ needs.codeql.result }}" == "failure" || "${{ needs.snyk.result }}" == "failure" || "${{ needs.sonarqube.result }}" == "failure" ]]; then
             echo "❌ **Security issues detected! Please review the scan results.**" >> $GITHUB_STEP_SUMMARY
           else
             echo "✅ **All security scans passed successfully!**" >> $GITHUB_STEP_SUMMARY
           fi
 
       - name: 🚨 Security Alert
-        if: needs.codeql.result == 'failure' || needs.snyk.result == 'failure'
+        if: needs.codeql.result == 'failure' || needs.snyk.result == 'failure' || needs.sonarqube.result == 'failure'
         run: |
           echo "🚨 SECURITY ISSUES DETECTED!"
           echo "Please review the security scan results immediately."