kinjo 0.3.8

Kinjo: mDNS TUI and commands launch for local network services
Documentation
name: SonarCloud analysis

# Project key/organization and the coverage report path live in
# sonar-project.properties; SONAR_TOKEN comes from the repo secrets.

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read # allows SonarCloud to decorate PRs with analysis results

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  analysis:
    # Dependabot and fork PRs run without access to repo secrets, so the scanner
    # would fail with an empty SONAR_TOKEN; main-branch analysis after merge
    # still covers those changes. `pull_request_target` would supply the token
    # but runs `cargo llvm-cov` — i.e. the PR's own build scripts and tests —
    # with the secret in scope, so it is deliberately not used here.
    if: >-
      github.actor != 'dependabot[bot]' &&
      (github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-24.04
    timeout-minutes: 45

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0  # full history improves blame and new-code detection
          persist-credentials: false

      - name: Set up build environment
        uses: ./.github/actions/setup
        with:
          install-avahi: true

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7 # v2
        with:
          tool: cargo-llvm-cov@0.8.7

      - name: Generate test coverage
        run: |
          rustup component add llvm-tools-preview
          cargo llvm-cov --locked --all-features --lcov --output-path lcov.info

      - name: Analyze with SonarCloud
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >-
            -Dsonar.qualitygate.wait=true
            -Dsonar.qualitygate.timeout=300