Integrated SonarCloud, dropped CodeClimate, fixed on-pr-closed workflow, dropped CodeQL workflow

.github/workflows/unit-tests.yaml

@@ -16,17 +16,39 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  tests-preflight:
+    name: Preflight Check
+    runs-on: ubuntu-latest
+    outputs:
+      PR_EXISTS: ${{ steps.pr-check.outputs.PR_EXISTS }}
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Short circuit if open PR exists for this branch (on push)
+        id: pr-check
+        if: github.event_name == 'push'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sleep 10
+          prs=$(gh pr list --head "${{ github.ref_name }}" --state open --repo "${{ github.repository }}" --json number --jq '.[].number')
+          if [ -n "$prs" ]; then
+            echo "PR_EXISTS=true" >> $GITHUB_OUTPUT
+          else
+            echo "PR_EXISTS=false" >> $GITHUB_OUTPUT
+          fi
+
   test-app:
     name: Unit Tests (App)
+    needs: tests-preflight
+    if: needs.tests-preflight.outputs.PR_EXISTS != 'true'
     runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'push' ||
-      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true)
     defaults:
       run:
         working-directory: app
     outputs:
-      HAS_CC_SECRETS: ${{ steps.check-secrets.outputs.HAS_CC_SECRETS }}
+      HAS_SONAR_SECRETS: ${{ steps.check-secrets.outputs.HAS_SONAR_SECRETS }}
     timeout-minutes: 10
     strategy:
       fail-fast: true
@@ -37,10 +59,10 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
-      - name: Check CodeClimate Secrets
+      - name: Check Sonar Secrets
         id: check-secrets
         run: |
-          echo "HAS_CC_SECRETS=${{ secrets.CC_TEST_REPORTER_ID != '' }}" >> $GITHUB_OUTPUT
+          echo "HAS_SONAR_SECRETS=${{ secrets.SONAR_TOKEN_APP != '' }}" >> $GITHUB_OUTPUT
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -74,8 +96,8 @@ jobs:
           path: ${{ github.workspace }}/app/coverage
           retention-days: 1
       - name: Monitor Coverage
-        if: "matrix.node-version == '22.x' && ! github.event.pull_request.head.repo.fork"
-        uses: slavcodev/coverage-monitor-action@v1
+        if: "matrix.node-version == '22.x' &&  github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork"
+        uses: slavcodev/coverage-monitor-action@398c4cbbb710e549a8407fdef96ae8b9454d0463 # 1.10.0
         with:
           comment_mode: update
           comment_footer: false
@@ -87,15 +109,14 @@ jobs:
 
   test-frontend:
     name: Unit Tests (Frontend)
+    needs: tests-preflight
+    if: needs.tests-preflight.outputs.PR_EXISTS != 'true'
     runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'push' ||
-      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true)
     defaults:
       run:
         working-directory: frontend
     outputs:
-      HAS_CC_SECRETS: ${{ steps.check-secrets.outputs.HAS_CC_SECRETS }}
+      HAS_SONAR_SECRETS: ${{ steps.check-secrets.outputs.HAS_SONAR_SECRETS }}
     timeout-minutes: 10
     strategy:
       fail-fast: true
@@ -106,10 +127,10 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
-      - name: Check CodeClimate Secrets
+      - name: Check Sonar Secrets
         id: check-secrets
         run: |
-          echo "HAS_CC_SECRETS=${{ secrets.CC_TEST_REPORTER_ID != '' }}" >> $GITHUB_OUTPUT
+          echo "HAS_SONAR_SECRETS=${{ secrets.SONAR_TOKEN_FRONTEND != '' }}" >> $GITHUB_OUTPUT
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -141,8 +162,8 @@ jobs:
           path: ${{ github.workspace }}/frontend/coverage
           retention-days: 1
       - name: Monitor Coverage
-        if: "matrix.node-version == '22.x' && ! github.event.pull_request.head.repo.fork"
-        uses: slavcodev/coverage-monitor-action@v1
+        if: "matrix.node-version == '22.x' &&  github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork"
+        uses: slavcodev/coverage-monitor-action@398c4cbbb710e549a8407fdef96ae8b9454d0463 # 1.10.0
         with:
           comment_mode: update
           comment_footer: false
@@ -152,24 +173,50 @@ jobs:
           threshold_alert: 50
           threshold_warning: 80
 
-  test-coverage:
-    name: Publish to Code Climate
+  test-coverage-app:
+    name: Publish App Coverage to SonarCloud
     needs:
       - test-app
+    if: needs.test-app.outputs.HAS_SONAR_SECRETS == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4.2.2
+      - name: Restore Coverage Results
+        uses: actions/download-artifact@v4.3.0
+        with:
+          name: coverage-app
+          path: ${{ github.workspace }}/app/coverage
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@8c71dc039c2dd71d3821e89a2b58ecc7fee6ced9 # v5.3.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_APP }}
+        with:
+          projectBaseDir: app
+
+  test-coverage-frontend:
+    name: Publish Frontend Coverage to SonarCloud
+    needs:
       - test-frontend
-    if: needs.test-app.outputs.HAS_CC_SECRETS == 'true'
+    if: needs.test-frontend.outputs.HAS_SONAR_SECRETS == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
       - name: Restore Coverage Results
-        uses: actions/download-artifact@v4
-      - name: Publish code coverage
-        uses: paambaati/codeclimate-action@v9
+        uses: actions/download-artifact@v4.3.0
+        with:
+          name: coverage-frontend
+          path: ${{ github.workspace }}/frontend/coverage
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@8c71dc039c2dd71d3821e89a2b58ecc7fee6ced9 # v5.3.0
         env:
-          CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_FRONTEND }}
         with:
-          coverageLocations: |
-            ${{ github.workspace }}/**/lcov.info:lcov
-          prefix: ${{ github.workplace }}
+          projectBaseDir: frontend

README.md

@@ -3,11 +3,17 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![Lifecycle:Experimental](https://img.shields.io/badge/Lifecycle-Experimental-339999)](https://github.com/bcgov/repomountie/blob/master/doc/lifecycle-badges.md)
 
-![Tests](https://github.com/bcgov/nr-permitconnect-navigator-service/workflows/Tests/badge.svg)
-[![Maintainability](https://api.codeclimate.com/v1/badges/77078c9bd93bd99d5840/maintainability)](https://codeclimate.com/github/bcgov/nr-permitconnect-navigator-service/maintainability)
-[![Test Coverage](https://api.codeclimate.com/v1/badges/77078c9bd93bd99d5840/test_coverage)](https://codeclimate.com/github/bcgov/nr-permitconnect-navigator-service/test_coverage)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=bcgov_nr-permitconnect-navigator-service&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=bcgov_nr-permitconnect-navigator-service)
+[![Tests](https://github.com/bcgov/nr-permitconnect-navigator-service/actions/workflows/unit-tests.yaml/badge.svg)](https://github.com/bcgov/nr-permitconnect-navigator-service/actions/workflows/unit-tests.yaml)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=bcgov_nr-permitconnect-navigator-service&metric=coverage)](https://sonarcloud.io/summary/new_code?id=bcgov_nr-permitconnect-navigator-service)
+[![CodeQL](https://github.com/bcgov/nr-permitconnect-navigator-service/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/bcgov/nr-permitconnect-navigator-service/actions/workflows/github-code-scanning/codeql)
 
-NR PermitConnect Navigator Service
+[![Reliability Rating](https://sonarcloud.io/api/project_badges/measure?project=bcgov_nr-permitconnect-navigator-service&metric=reliability_rating)](https://sonarcloud.io/summary/new_code?id=bcgov_nr-permitconnect-navigator-service)
+[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=bcgov_nr-permitconnect-navigator-service&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=bcgov_nr-permitconnect-navigator-service)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=bcgov_nr-permitconnect-navigator-service&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=bcgov_nr-permitconnect-navigator-service)
+[![Technical Debt](https://sonarcloud.io/api/project_badges/measure?project=bcgov_nr-permitconnect-navigator-service&metric=sqale_index)](https://sonarcloud.io/summary/new_code?id=bcgov_nr-permitconnect-navigator-service)
+
+NR Permit Connect Services Application
 
 ## Directory Structure
 
@@ -63,14 +69,14 @@ You can quickly run this application in development mode after cloning by openin
 - Create `.env` in the root directory with the following
   - `DATABASE_URL="your_connection_string"`
 
-```
+```sh
 cd app
 npm i
 npm run prisma:migrate
 npm run serve
 ```
 
-```
+```sh
 cd frontend
 npm i
 npm run serve

app/sonar-project.properties

@@ -0,0 +1,29 @@
+# Configuration (https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/analysis-parameters/)
+sonar.organization=bcgov-sonarcloud
+sonar.projectKey=bcgov-sonarcloud_nr-permitconnect-navigator-service_app
+sonar.projectName=nr-permitconnect-navigator-service app
+sonar.host.url=https://sonarcloud.io
+# sonar.verbose=true # Uncomment to enable very verbose sonar-scanner output
+
+# Path to sources is relative to the sonar-project.properties file. Defaults to .
+sonar.sources=.
+sonar.language=ts
+sonar.sourceEncoding=UTF-8
+# sonar.modules=src
+
+# Ignore database migrations and other folders
+sonar.exclusions=*.ts,**/cypress/**,**/coverage/**,**/migrations/**,**/node_modules/**,**/tests/**
+#sonar.inclusions=
+
+# Path to tests
+sonar.tests=tests
+
+# Identify the test files (https://docs.sonarsource.com/sonarqube-server/latest/project-administration/analysis-scope/#setting-the-initial-scope)
+#sonar.test.exclusions=
+sonar.test.inclusions=**/*spec.ts
+
+# Ignore copy-paste duplication scanning for tests
+sonar.cpd.exclusions=**/*spec.ts,**/cypress/**,**/test/**
+
+# Code coverage report location
+sonar.javascript.lcov.reportPaths=./coverage/lcov.info

frontend/sonar-project.properties

@@ -0,0 +1,29 @@
+# Configuration (https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/analysis-parameters/)
+sonar.organization=bcgov-sonarcloud
+sonar.projectKey=bcgov-sonarcloud_nr-permitconnect-navigator-service_frontend
+sonar.projectName=nr-permitconnect-navigator-service frontend
+sonar.host.url=https://sonarcloud.io
+# sonar.verbose=true # Uncomment to enable very verbose sonar-scanner output
+
+# Path to sources is relative to the sonar-project.properties file. Defaults to .
+sonar.sources=.
+sonar.language=ts
+sonar.sourceEncoding=UTF-8
+# sonar.modules=src
+
+# Ignore database migrations and other folders
+sonar.exclusions=*.ts,**/cypress/**,**/coverage/**,**/migrations/**,**/node_modules/**,**/tests/**
+#sonar.inclusions=
+
+# Path to tests
+sonar.tests=tests
+
+# Identify the test files (https://docs.sonarsource.com/sonarqube-server/latest/project-administration/analysis-scope/#setting-the-initial-scope)
+#sonar.test.exclusions=
+sonar.test.inclusions=**/*spec.ts
+
+# Ignore copy-paste duplication scanning for tests
+sonar.cpd.exclusions=**/*spec.ts,**/cypress/**,**/test/**
+
+# Code coverage report location
+sonar.javascript.lcov.reportPaths=./coverage/lcov.info