Pin GitHub Actions to full-length commit SHAs #4021

	name: Static analysis with SonarCloud
	on:
	workflow_dispatch:
	push:
	branches: [main, support/2.x.x]
	pull_request:
	types: [opened, synchronize, reopened]

	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

	jobs:
	checksecret:
	name: check if SONAR_TOKEN is set in github secrets
	runs-on: ubuntu-latest
	outputs:
	is_SONAR_TOKEN_set: ${{ steps.checksecret_job.outputs.is_SONAR_TOKEN_set }}
	steps:
	- name: Check whether unity activation requests should be done
	id: checksecret_job
	run: \|
	echo "is_SONAR_TOKEN_set=${{ env.SONAR_TOKEN != '' }}" >> $GITHUB_OUTPUT
	build:
	needs: [checksecret]
	if: needs.checksecret.outputs.is_SONAR_TOKEN_set == 'true'
	name: Build
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
	with:
	fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
	- name: Set up JDK
	uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
	with:
	java-version: 21
	distribution: 'temurin'
	cache: maven
	- name: Cache SonarCloud packages
	uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
	with:
	path: ~/.sonar/cache
	key: ${{ runner.os }}-sonar
	restore-keys: ${{ runner.os }}-sonar
	- name: Build and analyze
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
	run: ./mvnw verify sonar:sonar --no-transfer-progress -Dsonar.token=$SONAR_TOKEN

Navigation Menu