Merge pull request #3496 from huangruiteng/codex/sonarcloud

ci(sonarcloud): add non-blocking SonarCloud analysis

Author: huangruiteng

.github/workflows/sonarcloud.yml

@@ -0,0 +1,74 @@
+name: SonarCloud
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/sonarcloud.yml"
+      - "sonar-project.properties"
+      - "loopx/**"
+      - "apps/**"
+      - "scripts/**"
+      - "tests/**"
+      - "package.json"
+      - "package-lock.json"
+      - "pyproject.toml"
+      - "tsconfig.control-plane.json"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/sonarcloud.yml"
+      - "sonar-project.properties"
+      - "loopx/**"
+      - "apps/**"
+      - "scripts/**"
+      - "tests/**"
+      - "package.json"
+      - "package-lock.json"
+      - "pyproject.toml"
+      - "tsconfig.control-plane.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sonar:
+    name: SonarCloud analysis (non-blocking)
+    runs-on: ubuntu-latest
+    # Skip until maintainers provision SONAR_TOKEN so this is never a blocker.
+    if: ${{ secrets.SONAR_TOKEN != '' }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install test dependencies
+        run: python -m pip install --disable-pip-version-check -e ".[test]"
+
+      - name: Run fast tests with coverage XML
+        run: >-
+          python -m pytest -q -n 2
+          --cov=loopx
+          --cov-report=term
+          --cov-report=xml:coverage.xml
+
+      - name: SonarCloud scan
+        # Analysis-only: findings are reported to the PR/dashboard but never
+        # block merge. Remove this flag only if the quality gate becomes a
+        # required check.
+        continue-on-error: true
+        uses: SonarSource/sonarqube-scan-action@v8.2.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

sonar-project.properties

@@ -0,0 +1,23 @@
+sonar.organization=huangruiteng
+sonar.projectKey=huangruiteng_loopx
+sonar.projectName=LoopX
+
+# Public project links
+sonar.links.homepage=https://github.com/huangruiteng/loopx
+sonar.links.scm=https://github.com/huangruiteng/loopx
+
+sonar.sourceEncoding=UTF-8
+
+# Analyzed surfaces: Python product core, TypeScript/JavaScript product
+# surfaces, and helper scripts. Generated frontend bundles, legacy
+# deprecate/, and non-analyzed runtimes (Rust/Tauri) are excluded.
+sonar.sources=loopx,apps,scripts
+sonar.tests=tests
+sonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/src-tauri/**,loopx/web/chat/assets/**,**/*.min.js,deprecate/**
+
+# Python
+sonar.python.version=3.11
+sonar.python.coverage.reportPaths=coverage.xml
+
+# Non-blocking by default: report findings, never gate the workflow.
+sonar.qualitygate.wait=false