code-gomod_go-sonarcloud-analysis.yml

# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0

name: code-gomod-go-sonarcloud-analysis
run-name: SonarCloud analysis on ${{ github.head_ref || github.ref_name }}

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main, main-*, develop, develop-*]
  push:
    branches: [main, main-*, develop, develop-*]

permissions:
  contents: read

concurrency:
  group: code-gomod-go-sonarcloud-${{ github.repository }}-${{ github.ref }}
  cancel-in-progress: true

env:
  WORKING_DIRECTORY: ${{ vars.WORKING_DIRECTORY }}
  ASDF_BRANCH_VERSION: '0.18.0'

jobs:
  analyze:
    name: SonarCloud / Analyze
    if: >-
      vars.SONARCLOUD_ENABLED == 'true' &&
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
      (
        (
          vars.DEVELOPMENT_FLOW == 'trunk-based-development' &&
          (
            (github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || startsWith(github.ref_name, 'main-'))) ||
            (github.event_name == 'pull_request' && (github.event.pull_request.base.ref == 'main' || startsWith(github.event.pull_request.base.ref, 'main-'))) ||
            (github.event_name == 'push' && (github.ref_name == 'main' || startsWith(github.ref_name, 'main-')))
          )
        ) ||
        (
          vars.DEVELOPMENT_FLOW == 'git-flow' &&
          (
            (github.event_name == 'workflow_dispatch' && (github.ref_name == 'develop' || startsWith(github.ref_name, 'develop-'))) ||
            (github.event_name == 'pull_request' && (github.event.pull_request.base.ref == 'develop' || startsWith(github.event.pull_request.base.ref, 'develop-'))) ||
            (github.event_name == 'push' && (github.ref_name == 'develop' || startsWith(github.ref_name, 'develop-')))
          )
        )
      )
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Resolve SonarCloud availability
        id: sonar
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${SONAR_TOKEN:-}" ]]; then
            echo "::notice title=SonarCloud skipped::SONAR_TOKEN is not configured; skipping advisory analysis."
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Check out source
        if: steps.sonar.outputs.enabled == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Read governed tool versions
        id: tool-versions
        if: steps.sonar.outputs.enabled == 'true'
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          resolved=""
          if [[ -f .tool-versions ]]; then
            if grep -vE '^[[:space:]]*(#|$)' .tool-versions | grep -qvE '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$'; then
              echo "::error title=Invalid tool-versions::${WORKING_DIRECTORY}/.tool-versions is malformed."
              exit 1
            fi
            resolved="$(grep -E '^golang ' .tool-versions || true)"
          fi
          if [[ -z "$resolved" ]]; then
            if [[ ! -f go.mod ]]; then
              echo "::error title=Missing go toolchain::${WORKING_DIRECTORY} has no golang pin in .tool-versions and no go.mod to derive one from."
              exit 1
            fi
            version="$(sed -nE 's/^toolchain[[:space:]]+go([0-9]+\.[0-9]+(\.[0-9]+)?)[[:space:]]*$/\1/p' go.mod | head -n 1)"
            if [[ -z "$version" ]]; then
              version="$(sed -nE 's/^go[[:space:]]+([0-9]+\.[0-9]+(\.[0-9]+)?)[[:space:]]*$/\1/p' go.mod | head -n 1)"
            fi
            if [[ -z "$version" ]]; then
              echo "::error title=Missing go toolchain::${WORKING_DIRECTORY}/go.mod declares no usable go version."
              exit 1
            fi
            if [[ "$version" != *.*.* ]]; then
              version="${version}.0"
            fi
            resolved="golang ${version}"
            echo "::notice title=Derived go toolchain::Using ${resolved} from ${WORKING_DIRECTORY}/go.mod."
          fi
          {
            echo "tool_versions<<EOF"
            echo "$resolved"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up asdf-managed Go
        if: steps.sonar.outputs.enabled == 'true'
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1
        with:
          tool_versions: ${{ steps.tool-versions.outputs.tool_versions }}
          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}

      - name: Generate Go coverage profile
        if: steps.sonar.outputs.enabled == 'true'
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          go test -covermode=atomic -coverprofile=coverage.out ./... \
            || echo "::warning title=Coverage unavailable::go test produced no coverage profile; Sonar will analyze without coverage."

      - name: Resolve SonarCloud project version
        if: steps.sonar.outputs.enabled == 'true'
        run: |
          project_version="$(git for-each-ref --sort=refname --sort=-creatordate \
            --format='%(refname:lstrip=2)' refs/tags \
            | grep -E '^([A-Za-z0-9][A-Za-z0-9._-]*-)?v?[0-9]+\.[0-9]+\.[0-9]+$' \
            | head -n 1 || true)"
          if [[ -n "$project_version" ]]; then
            echo "SONAR_PROJECT_VERSION_ARG=-Dsonar.projectVersion=${project_version}" >> "$GITHUB_ENV"
          else
            echo "::notice title=SonarCloud project version::No release tag found; the analysis runs without sonar.projectVersion."
            echo "SONAR_PROJECT_VERSION_ARG=" >> "$GITHUB_ENV"
          fi

      - name: Run SonarCloud analysis
        if: steps.sonar.outputs.enabled == 'true'
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          SONAR_HOST_URL: https://sonarcloud.io
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >-
            -Dsonar.organization=inditextech
            -Dsonar.projectKey=InditexTech_${{ github.event.repository.name }}
            -Dsonar.projectName=${{ github.event.repository.name }}
            -Dsonar.sources=${{ env.WORKING_DIRECTORY }}
            -Dsonar.tests=${{ env.WORKING_DIRECTORY }}
            -Dsonar.test.inclusions=**/*_test.go
            -Dsonar.exclusions=**/vendor/**,**/dist/**
            -Dsonar.go.coverage.reportPaths=${{ env.WORKING_DIRECTORY }}/coverage.out
            ${{ env.SONAR_PROJECT_VERSION_ARG }}