sqlite-diff-rs 0.12.0

Build SQLite changeset and patchset binary formats programmatically, without SQLite
Documentation
---
name: Sonar

"on":
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: sonar-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  sonar:
    name: SonarQube scan
    runs-on: ubuntu-latest
    timeout-minutes: 45
    # Neither a fork's pull request nor a Dependabot run can read SONAR_TOKEN,
    # so the scan runs for same-repo human branches and pushes to main only.
    if: >-
      github.event_name == 'push' ||
      (github.event.pull_request.head.repo.full_name == github.repository &&
      github.event.pull_request.user.login != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v7
        with:
          # Full history improves blame-based new-code attribution.
          fetch-depth: 0
          # Later steps never talk to git, so keep the token out of git config.
          persist-credentials: false

      - name: Cache cargo downloads
        uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: dl-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            dl-${{ runner.os }}-

      - name: Install stable clippy
        run: |
          rustup toolchain install stable \
            --profile minimal \
            --component clippy

      - name: Clippy report
        # Token-free clippy run. The scan step only imports this report, so
        # SONAR_TOKEN never reaches dependency build scripts or proc macros.
        run: cargo clippy --message-format=json > clippy-report.json

      - name: SonarQube scan
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}