From ea735cf164faa49ba7e4254c36c56ca1fc434a46 Mon Sep 17 00:00:00 2001 From: Wessel Verheij Date: Tue, 28 Jul 2026 00:29:59 +0200 Subject: [PATCH 1/2] ci: analyse this repository explicitly, not automatically MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sibling repositories are covered by SonarCloud's automatic analysis. This one is not, and quietly: it holds no application source, so the detector finds no language it recognises, the project sits empty, and a badge pointed at it never resolves. sonar-project.properties tells the scan where to look — the markdown and workflow files that are the substance of a community-health repository — and declares the absence of a test tree rather than leaving it to be inferred and reported as zero coverage against files that have no tests by design. Only this repo gets the workflow. The others keep automatic analysis, which suits them. Signed-off-by: Wessel Verheij --- .github/workflows/sonar.yml | 35 +++++++++++++++++++++++++++++++++++ sonar-project.properties | 15 +++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 .github/workflows/sonar.yml create mode 100644 sonar-project.properties diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml new file mode 100644 index 0000000..2f56fd2 --- /dev/null +++ b/.github/workflows/sonar.yml @@ -0,0 +1,35 @@ +# SonarCloud analysis for the community-health repository. +# +# Explicit rather than automatic. This repo holds no application source, so +# SonarCloud's automatic analysis finds no language it recognises and reports +# nothing — the project sits empty and the badge never resolves. A scan told +# where to look via sonar-project.properties produces a real result for the +# markdown and workflow files that are the substance here. +# +# The sibling repositories keep automatic analysis; only this one needs the +# workflow, because only this one has nothing for the detector to find. +name: sonar + +on: + push: + branches: [main] + pull_request: + +permissions: + contents: read + +jobs: + sonar: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + # Sonar attributes new code to the commits that introduced it, and a + # shallow clone leaves it guessing. + fetch-depth: 0 + + - name: SonarCloud scan + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/sonar-project.properties b/sonar-project.properties new file mode 100644 index 0000000..ee58161 --- /dev/null +++ b/sonar-project.properties @@ -0,0 +1,15 @@ +sonar.projectKey=beatrax-app_.github +sonar.organization=beatrax-app + +# A configuration repository: community-health files, issue templates and the +# workflows that carry them. There is no application source, so the scan has to +# be told what to look at — automatic analysis finds no recognised language here +# and reports nothing at all. +sonar.sources=. +sonar.exclusions=**/*.png,**/*.svg,.github/ISSUE_TEMPLATE/** + +# No test tree. Declared empty rather than left unset so the scanner does not +# infer one and then report zero coverage against files that have no tests by +# design. +sonar.tests= +sonar.sourceEncoding=UTF-8 From 3c8c8d246103119d20976e993f1556c95ce571e1 Mon Sep 17 00:00:00 2001 From: Wessel Verheij Date: Tue, 28 Jul 2026 00:37:22 +0200 Subject: [PATCH 2/2] fix(ci): the SonarCloud organization key is beatrax MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scan failed with "Organization key 'beatrax-app' does not exist" — the GitHub organisation and the SonarCloud one do not share a name, and the project key does: beatrax-app_.github under organisation beatrax. Spec: GOV-R12 Signed-off-by: Wessel Verheij --- sonar-project.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sonar-project.properties b/sonar-project.properties index ee58161..19aee6e 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -1,5 +1,5 @@ sonar.projectKey=beatrax-app_.github -sonar.organization=beatrax-app +sonar.organization=beatrax # A configuration repository: community-health files, issue templates and the # workflows that carry them. There is no application source, so the scan has to