code-npm_node-sonarcloud-analysis.yml

# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0

name: code-npm-node-sonarcloud-analysis
run-name: SonarCloud analysis on ${{ github.head_ref || github.ref_name }}

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main, main-*, develop, develop-*]
  push:
    branches: [main, main-*, develop, develop-*]

permissions:
  contents: read

concurrency:
  group: code-npm-node-sonarcloud-${{ github.repository }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PROJECT_TYPE: ${{ vars.PROJECT_TYPE }}
  WORKING_DIRECTORY: ${{ vars.WORKING_DIRECTORY }}
  ASDF_BRANCH_VERSION: '0.18.0'

jobs:
  analyze:
    name: SonarCloud / Analyze
    if: >-
      vars.SONARCLOUD_ENABLED == 'true' &&
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
      (
        (
          vars.DEVELOPMENT_FLOW == 'trunk-based-development' &&
          (
            (github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || startsWith(github.ref_name, 'main-'))) ||
            (github.event_name == 'pull_request' && (github.event.pull_request.base.ref == 'main' || startsWith(github.event.pull_request.base.ref, 'main-'))) ||
            (github.event_name == 'push' && (github.ref_name == 'main' || startsWith(github.ref_name, 'main-')))
          )
        ) ||
        (
          vars.DEVELOPMENT_FLOW == 'git-flow' &&
          (
            (github.event_name == 'workflow_dispatch' && (github.ref_name == 'develop' || startsWith(github.ref_name, 'develop-'))) ||
            (github.event_name == 'pull_request' && (github.event.pull_request.base.ref == 'develop' || startsWith(github.event.pull_request.base.ref, 'develop-'))) ||
            (github.event_name == 'push' && (github.ref_name == 'develop' || startsWith(github.ref_name, 'develop-')))
          )
        )
      )
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Read governed tool versions
        id: tool-versions
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          # Reject any .tool-versions line that is not a strict "<plugin> <version>" before asdf reads it (npm is pinned via package.json packageManager, not here).
          if grep -Evq '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$' .tool-versions; then
            echo "::error title=Invalid tool-versions::${WORKING_DIRECTORY}/.tool-versions is malformed."
            exit 1
          fi
          {
            echo "tool_versions<<EOF"
            cat .tool-versions
            echo
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up asdf-managed Node
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.0
        with:
          tool_versions: ${{ steps.tool-versions.outputs.tool_versions }}
          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}

      - name: Build and test with coverage
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          # `test` is the governed lifecycle script and must emit the lcov report the scanner reads; build runs first so the scanner sees buildable sources.
          case "$PROJECT_TYPE" in
            single|workspaces)
              npm ci
              npm run build
              npm run test
              ;;
            *)
              echo "::error title=Invalid project type::PROJECT_TYPE must be single or workspaces."
              exit 1
              ;;
          esac

      - name: Resolve SonarCloud analysis scope
        shell: bash
        run: |
          set -euo pipefail
          # Resolve sonar.sources and lcov coverage paths from the repository root; a workspaces build contributes every member so none is silently excluded.
          case "$PROJECT_TYPE" in
            single)
              sonar_sources="${WORKING_DIRECTORY}"
              sonar_coverage="${WORKING_DIRECTORY}/coverage/lcov.info"
              ;;
            workspaces)
              sources=()
              coverage=()
              for member_dir in "${WORKING_DIRECTORY}"/packages/*/; do
                member_dir="${member_dir%/}"
                # Only members with a package.json are analyzable units; skip stray directories under packages/.
                if [[ ! -f "${member_dir}/package.json" ]]; then
                  continue
                fi
                sources+=("${member_dir}")
                # Attribute each member's coverage from its own lcov report; the scanner ignores a path a member without tests never wrote.
                coverage+=("${member_dir}/coverage/lcov.info")
              done
              if [[ "${#sources[@]}" -eq 0 ]]; then
                echo "::error title=No workspaces members::No ${WORKING_DIRECTORY}/packages/*/package.json members were found." >&2
                exit 1
              fi
              sonar_sources="$(IFS=,; printf '%s' "${sources[*]}")"
              sonar_coverage="$(IFS=,; printf '%s' "${coverage[*]}")"
              ;;
            *)
              echo "::error title=Invalid project type::PROJECT_TYPE must be single or workspaces." >&2
              exit 1
              ;;
          esac
          {
            echo "SONAR_SOURCES=${sonar_sources}"
            echo "SONAR_COVERAGE_PATHS=${sonar_coverage}"
          } >> "$GITHUB_ENV"

      - name: Run SonarCloud analysis
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          SONAR_HOST_URL: https://sonarcloud.io
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >-
            -Dsonar.organization=inditextech
            -Dsonar.projectKey=InditexTech_${{ github.event.repository.name }}
            -Dsonar.projectName=${{ github.event.repository.name }}
            -Dsonar.sources=${{ env.SONAR_SOURCES }}
            -Dsonar.test.inclusions=**/*.test.js,**/*.test.jsx,**/*.test.mjs,**/*.test.cjs,**/*.test.ts,**/*.test.tsx,**/*.spec.js,**/*.spec.jsx,**/*.spec.ts,**/*.spec.tsx
            -Dsonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/coverage/**
            -Dsonar.javascript.lcov.reportPaths=${{ env.SONAR_COVERAGE_PATHS }}