analysis.yml

name: Code Analysis
on:
  workflow_run:
    workflows: ["Build and Test"]
    types: [completed]

jobs:
  sonar:
    name: SonarQube Analysis
    runs-on: ubuntu-latest
    permissions:
      checks: write
      actions: read
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'pull_request') &&
      github.event.workflow_run.head_repository.full_name == github.repository
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
        with:
          java-version: '17'
          distribution: 'zulu'
          cache: 'gradle'

      - name: Cache SonarQube packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1

      - name: Download coverage report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-report
          path: build/reports/kover
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download test results
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: junit-test-results
          path: build/test-results
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve PR details
        id: pr
        if: github.event.workflow_run.event == 'pull_request'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WR_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
          WR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          WR_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
          WR_BASE_REF: ${{ github.event.workflow_run.pull_requests[0].base.ref }}
        run: |
          # workflow_run.pull_requests can be empty for fork PRs, fall back to API search
          PR_NUMBER="$WR_PR_NUMBER"
          if [ -z "$PR_NUMBER" ]; then
            PR_NUMBER=$(gh pr list --search "$WR_HEAD_SHA" --state open --json number --jq '.[0].number // empty')
          fi
          if [ -z "$PR_NUMBER" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "Could not resolve PR number, skipping PR-specific analysis"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
            echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
            echo "branch=$WR_HEAD_BRANCH" >> "$GITHUB_OUTPUT"
            echo "base=${WR_BASE_REF:-main}" >> "$GITHUB_OUTPUT"
          fi

      - name: Run SonarQube Analysis (PR)
        if: github.event.workflow_run.event == 'pull_request' && steps.pr.outputs.skip != 'true'
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: >-
          ./gradlew sonar
          -Dsonar.coverage.jacoco.xmlReportPaths=${{ github.workspace }}/build/reports/kover/report.xml
          -Dsonar.pullrequest.key=${{ steps.pr.outputs.number }}
          -Dsonar.pullrequest.branch=${{ steps.pr.outputs.branch }}
          -Dsonar.pullrequest.base=${{ steps.pr.outputs.base }}

      - name: Run SonarQube Analysis (push)
        if: github.event.workflow_run.event == 'push'
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: >-
          ./gradlew sonar
          -Dsonar.coverage.jacoco.xmlReportPaths=${{ github.workspace }}/build/reports/kover/report.xml

  coverage-comment:
    name: Coverage PR Comment
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      actions: read
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'pull_request'
    steps:
      - name: Download coverage report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-report
          path: build/reports/kover
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve PR number
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WR_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
          WR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        run: |
          PR_NUMBER="$WR_PR_NUMBER"
          if [ -z "$PR_NUMBER" ]; then
            PR_NUMBER=$(gh pr list --search "$WR_HEAD_SHA" --state open --json number --jq '.[0].number // empty')
          fi
          if [ -n "$PR_NUMBER" ]; then
            echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
          else
            echo "Could not resolve PR number"
            exit 1
          fi

      - name: Parse coverage and post comment
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          PR_NUMBER: ${{ steps.pr.outputs.number }}
          REPO: ${{ github.repository }}
        run: |
          REPORT="build/reports/kover/report.xml"
          if [ ! -f "$REPORT" ]; then
            echo "Coverage report not found at $REPORT"
            exit 1
          fi

          # Extract coverage counters from the Kover/JaCoCo XML report
          # Parse the top-level <counter> elements for INSTRUCTION, BRANCH, and LINE
          extract_coverage() {
            local type=$1
            local missed covered total pct
            missed=$(grep -oP "<counter type=\"$type\" missed=\"\K[0-9]+" "$REPORT" | tail -1)
            covered=$(grep -oP "<counter type=\"$type\" covered=\"\K[0-9]+" "$REPORT" | tail -1)
            if [ -n "$missed" ] && [ -n "$covered" ]; then
              total=$((missed + covered))
              if [ "$total" -gt 0 ]; then
                pct=$(( (covered * 10000) / total ))
                echo "$(( pct / 100 )).$(printf '%02d' $(( pct % 100 )))%"
              else
                echo "N/A"
              fi
            else
              echo "N/A"
            fi
          }

          LINE_COV=$(extract_coverage "LINE")
          BRANCH_COV=$(extract_coverage "BRANCH")
          INSTRUCTION_COV=$(extract_coverage "INSTRUCTION")

          BODY=$(cat <<EOF
          ## Code Coverage

          | Metric | Coverage |
          |--------|----------|
          | Line | $LINE_COV |
          | Branch | $BRANCH_COV |
          | Instruction | $INSTRUCTION_COV |

          *Updated for commit ${WR_HEAD_SHA}*
          EOF
          )

          # Find existing coverage comment to update, or create a new one
          EXISTING_COMMENT=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
            --jq '.[] | select(.body | startswith("## Code Coverage")) | .id' | head -1)

          if [ -n "$EXISTING_COMMENT" ]; then
            gh api "repos/${REPO}/issues/comments/${EXISTING_COMMENT}" \
              -X PATCH -f body="$BODY"
          else
            gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
              -X POST -f body="$BODY"
          fi