sonar.yml

name: Sonar Analysis + Sync

on:
  workflow_call:
    inputs:
      projectKey:
        required: false
        type: string
      organisation:
        required: true
        type: string
    secrets:
      SONAR_TOKEN:
        required: true

jobs:
  analyse:
    runs-on: ubuntu-latest

    outputs:
      is_main: ${{ steps.branch.outputs.is_main }}
      resolved_project: ${{ steps.project.outputs.project }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect branch
        id: branch
        shell: bash
        run: |
          BRANCH="${GITHUB_REF##*/}"
          if [[ "$BRANCH" == "main" || "$BRANCH" == "master" ]]; then
            echo "is_main=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_main=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Resolve project key
        id: project
        shell: bash
        run: |
          if [ -n "${{ inputs.projectKey }}" ]; then
            echo "project=${{ inputs.projectKey }}" >> "$GITHUB_OUTPUT"
          else
            echo "project=${GITHUB_REPOSITORY#*/}" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Install SonarScanner
        run: dotnet tool install --global dotnet-sonarscanner

      - name: Detect test projects
        id: tests
        shell: bash
        run: |
          EXCLUSIONS=$(find . -name "*.Test*.csproj" \
            | sed 's|^\./||' \
            | sed 's|/[^/]*$|/**|' \
            | tr '\n' ',')
      
          EXCLUSIONS=${EXCLUSIONS#,}
      
          echo "exclusions=$EXCLUSIONS" >> "$GITHUB_OUTPUT"

      - name: Restore
        run: dotnet restore

      - name: Begin Sonar
        shell: bash
        run: |
          dotnet sonarscanner begin \
            /k:"${{ steps.project.outputs.project }}" \
            /o:"${{ inputs.organisation }}" \
            /d:sonar.login="${{ secrets.SONAR_TOKEN }}" \
            /d:sonar.host.url="https://sonarcloud.io" \
            /d:sonar.exclusions="${{ steps.tests.outputs.exclusions }}"

      - name: Build
        run: dotnet build --no-restore

      - name: End Sonar
        shell: bash
        run: |
          dotnet sonarscanner end \
            /d:sonar.login="${{ secrets.SONAR_TOKEN }}"

  sync-issues:
    needs: analyse
    if: needs.analyse.outputs.is_main == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Fetch Sonar Issues
        shell: bash
        run: |
          curl -u "${{ secrets.SONAR_TOKEN }}:" \
          "https://sonarcloud.io/api/issues/search?componentKeys=${{ needs.analyse.outputs.resolved_project }}&severities=BLOCKER,CRITICAL&resolved=false" \
          -o sonar.json

      - name: Sync Issues to GitHub
        uses: actions/github-script@v7
        env:
          PROJECT_KEY: ${{ needs.analyse.outputs.resolved_project }}
        with:
          script: |
            const fs = require('fs');
            const sonar = JSON.parse(fs.readFileSync('sonar.json', 'utf8'));

            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const projectKey = process.env.PROJECT_KEY;

            const existingIssues = await github.paginate(
              github.rest.issues.listForRepo,
              { owner, repo, state: "open", per_page: 100 }
            );

            const map = new Map();

            for (const issue of existingIssues) {
              const match = issue.body?.match(/Sonar Key: ([A-Za-z0-9_-]+)/);
              if (match) map.set(match[1], issue);
            }

            const active = new Set();

            for (const s of sonar.issues) {
              const key = s.key;
              active.add(key);

              const body = [
                `Sonar Key: ${key}`,
                ``,
                `Severity: ${s.severity}`,
                `Type: ${s.type}`,
                ``,
                `File: ${s.component}`,
                `Line: ${s.line}`,
                ``,
                `Link:`,
                `https://sonarcloud.io/project/issues?id=${projectKey}&issues=${key}`
              ].join('\n');

              const title = `[Sonar] ${s.message}`;

              if (map.has(key)) {
                await github.rest.issues.update({
                  owner,
                  repo,
                  issue_number: map.get(key).number,
                  title,
                  body
                });
              } else {
                await github.rest.issues.create({
                  owner,
                  repo,
                  title,
                  body,
                  labels: ["sonar", s.severity.toLowerCase()]
                });
              }
            }

            for (const [key, issue] of map.entries()) {
              if (!active.has(key)) {
                await github.rest.issues.update({
                  owner,
                  repo,
                  issue_number: issue.number,
                  state: "closed"
                });
              }
            }