Enable SonarQube scan for forked PRs

Author: deacon-mp

.github/workflows/quality.yml

@@ -74,47 +74,56 @@ jobs:
         #     -Dsonar.projectBaseDir=caldera
 
   # --- Sonar scan for forked PRs (runs safely with pull_request_target) ---
-  # sonar_fork_pr:
-  #   runs-on: ubuntu-latest
-  #   if: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.fork }}
-  #   permissions:
-  #     contents: read
-  #     pull-requests: write   # needed only for PR comments/decorations
-  #   steps:
-  #     # Checkout the base repo at the base SHA for context (not fork code)
-  #     - name: Checkout base repo
-  #       uses: actions/checkout@v4
-  #       with:
-  #         ref: ${{ github.event.pull_request.base.sha }}
-  #         fetch-depth: 0
+sonar_fork_pr:
+  runs-on: ubuntu-latest
+  if: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.fork }}
+  permissions:
+    contents: read
+    pull-requests: write   # remove if you don't want PR comments
+  steps:
+    - name: Checkout base repo
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.base.sha }}
+        fetch-depth: 0
 
-  #     # Checkout the fork’s PR head as data into ./pr
-  #     - name: Checkout PR HEAD (fork)
-  #       uses: actions/checkout@v4
-  #       with:
-  #         repository: ${{ github.event.pull_request.head.repo.full_name }}
-  #         ref: ${{ github.event.pull_request.head.sha }}
-  #         path: pr
-  #         fetch-depth: 0
-  #         submodules: recursive
+    - name: Checkout PR HEAD (fork)
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        ref: ${{ github.event.pull_request.head.sha }}
+        path: pr
+        fetch-depth: 0
+        submodules: recursive
 
-  #     # Optional debug info
-  #     - name: Debug checkout
-  #       run: |
-  #         echo "PR #${{ github.event.pull_request.number }}"
-  #         echo "Head: ${{ github.event.pull_request.head.ref }} @ ${{ github.event.pull_request.head.sha }}"
-  #         echo "Base: ${{ github.event.pull_request.base.ref }} @ ${{ github.event.pull_request.base.sha }}"
-  #         ls -la pr || true
+    # Detect where the sonar-project.properties actually is (pr/ or pr/caldera)
+    - name: Detect Sonar base dir
+      id: detect
+      run: |
+        set -euo pipefail
+        if [ -f pr/caldera/sonar-project.properties ]; then
+          echo "base=pr/caldera" >> "$GITHUB_OUTPUT"
+        elif [ -f pr/sonar-project.properties ]; then
+          echo "base=pr" >> "$GITHUB_OUTPUT"
+        else
+          echo "No sonar-project.properties found under pr/ or pr/caldera"
+          echo "base=pr" >> "$GITHUB_OUTPUT"   # fallback to repo root
+        fi
+        echo "Using base dir: $(grep '^base=' "$GITHUB_OUTPUT" | cut -d= -f2)"
+        echo "Has SONAR_TOKEN? $([ -n "${SONAR_TOKEN:-}" ] && echo yes || echo no)"
+      env:
+        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
-  #     # Run Sonar scan against fork code
-  #     - name: SonarQube Scan (fork PR)
-  #       uses: SonarSource/[email protected]
-  #       env:
-  #         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  #       with:
-  #         projectBaseDir: pr/caldera        # <— override the action’s default "."
-  #         args: |
-  #           -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
-  #           -Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
-  #           -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
+    # If your project key/org are NOT in the properties file, uncomment and set below
+    - name: SonarQube Scan (fork PR)
+      uses: SonarSource/[email protected]
+      env:
+        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # SONAR_HOST_URL: https://sonarcloud.io  # set if you’re self-hosted or non-default
+      with:
+        projectBaseDir: ${{ steps.detect.outputs.base }}
+        args: |
+          -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
+          -Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
+          -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}