name: Analyze PR

on:

workflow_run:

workflows:

- 'Build'

types:

- completed

permissions:

pull-requests: read

contents: read

checks: write

env:

BUILD_JAVA_VERSION: '21'

jobs:

analyze:

name: Analyze Code

# Only run on forks, in-repo PRs are analyzed directly

if: github.event.workflow_run.head_repository.owner.login != 'dnsjava'

runs-on: ubuntu-latest

steps:

- name: Download PR number artifact

id: get_pr_number

uses: dawidd6/action-download-artifact@v6

with:

workflow: ${{ github.event.workflow_run.name }}

run_id: ${{ github.event.workflow_run.id }}

name: pr_number

- name: Read Pull Request Number

id: pr_number

run: |

PR=$(cat pr_number.txt)

echo "pr_number=${PR}" >> "$GITHUB_OUTPUT"

- name: Request PR data from GitHub API

id: get_pr_data

if: steps.get_pr_number.outputs.found_artifact

uses: octokit/request-action@v2.x

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

with:

route: GET /repos/{full_name}/pulls/{number}

full_name: ${{ github.event.repository.full_name }}

number: ${{ steps.pr_number.outputs.pr_number }}

- name: Checkout PR

uses: actions/checkout@v4

with:

repository: ${{ github.event.workflow_run.head_repository.full_name }}

ref: ${{ github.event.workflow_run.head_sha }}

persist-credentials: false

# for Sonar

fetch-depth: 0

- name: Make sure 'base' doesn't exist

shell: bash

run: rm -rf base

- name: Checkout base

uses: actions/checkout@v4

with:

repository: ${{ github.event.repository.full_name }}

ref: ${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}

persist-credentials: false

path: base

- name: Get analysis data

uses: ./base/.github/actions/prepare-analysis

- name: Run SonarQube

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

WF_REVISION: ${{ github.event.workflow_run.head_sha }}

WF_PRKEY: ${{ fromJson(steps.get_pr_data.outputs.data).number }}

WF_BRANCH: ${{ fromJson(steps.get_pr_data.outputs.data).head.ref }}

WF_BASE: ${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}

run: |

cp -f base/pom.xml .

mvn -B \

-Dsonar.scm.revision='${WF_REVISION}' \

-Dsonar.pullrequest.key='${WF_PRKEY}' \

-Dsonar.pullrequest.branch='${WF_BRANCH}' \

-Dsonar.pullrequest.base='${WF_BASE}' \

properties:read-project-properties \

org.sonarsource.scanner.maven:sonar-maven-plugin:sonar