code-analysis.yml

name: Code Analysis
on: [push, pull_request]
jobs:
  init:
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    name: Initialization
    uses: ./.github/workflows/init.yml
    secrets: inherit

  build:
    name: Waiting for build
    needs: init
    runs-on: ubuntu-latest
    steps:
      - name: Wait for build
        uses: lewagon/wait-on-check-action@v1.2.0
        with:
          ref: ${{ github.ref }}
          check-name: 'Building Tomcat JSS'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 30
        if: github.event_name == 'push'

      - name: Wait for build
        uses: lewagon/wait-on-check-action@v1.2.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          check-name: 'Building Tomcat JSS'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 30
        if: github.event_name == 'pull_request'

  sonarcloud:
    name: SonarCloud
    needs: [init, build] 
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/tomcatjss
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Retrieve tomcatjss-runner image
        uses: actions/cache@v3
        with:
          key: tomcatjss-runner-${{ github.sha }}
          path: tomcatjss-runner.tar

      - name: Load tomcatjss-runner image
        run: docker load --input tomcatjss-runner.tar

      - name: Run container
        run: |
          IMAGE=tomcatjss-runner \
          NAME=pki \
          tests/bin/runner-init.sh

      - name: Copy builds in current folder
        run: |
          mkdir build
          docker cp pki:/usr/share/java/tomcatjss.jar build/

      - name: Remove maven related file
        run: rm -f pom.xml

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  get-pr-ref:
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
    name: Sonar cloud PR fork analyses deferring
    runs-on: ubuntu-latest
    steps:
      - name: Save PR information
        run: |
          mkdir -p ./pr
          echo ${{ github.event.number }} > ./pr/NR
          echo ${{ github.event.pull_request.base.ref }} > ./pr/BaseBranch

      - name: Upload pr as artifact
        uses: actions/upload-artifact@v3
        with:
          name: pr
          path: pr/

  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          severity: warning