ci: run SonarCloud on fork pull requests

Outside-contributor PRs cannot run SonarCloud directly because fork PRs have
no access to SONAR_TOKEN. Add a workflow_run-triggered SonarCloud (fork PRs)
workflow that calls the new reusable workflow in actions-common, and have the
build workflow upload the PR number/base so the fork scan decorates the
correct pull request.

Author: glennawatson

.github/workflows/ci-build.yml

@@ -19,3 +19,27 @@ jobs:
             minverMinimumMajorMinor: '10.2'
         secrets:
             CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+    # Fork PRs cannot run SonarCloud directly (no access to SONAR_TOKEN). Record
+    # the PR number + base branch so the trusted, workflow_run-triggered
+    # SonarCloud (fork PRs) workflow can decorate the correct pull request.
+    save-pr-metadata:
+        if: github.event_name == 'pull_request'
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+        steps:
+            - name: Write PR metadata
+              env:
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+                  PR_BASE: ${{ github.event.pull_request.base.ref }}
+              run: |
+                  mkdir -p pr-meta
+                  printf '%s' "$PR_NUMBER" > pr-meta/number
+                  printf '%s' "$PR_BASE" > pr-meta/base
+            - name: Upload PR metadata
+              uses: actions/upload-artifact@v7
+              with:
+                  name: pr-number
+                  path: pr-meta/
+                  retention-days: 1

.github/workflows/sonarcloud-fork.yml

@@ -0,0 +1,39 @@
+name: SonarCloud (fork PRs)
+
+# Runs SonarCloud analysis for pull requests opened from forks, which cannot run
+# the standard SonarCloud workflow because fork PRs have no access to
+# SONAR_TOKEN. Triggered by `workflow_run` once the untrusted "Build" workflow
+# finishes, so this runs in the base repo's trusted context (token available).
+# See the SECURITY note in workflow-common-sonarcloud-fork.yml.
+
+on:
+    workflow_run:
+        workflows: [ "Build" ]
+        types: [ completed ]
+
+permissions:
+    contents: read
+    actions: read
+
+jobs:
+    sonarcloud-fork:
+        # Only for fork PR builds that succeeded. Same-repo PRs are already
+        # analysed by sonarcloud.yml, so they are excluded here.
+        if: >-
+            github.event.workflow_run.event == 'pull_request' &&
+            github.event.workflow_run.conclusion == 'success' &&
+            github.event.workflow_run.head_repository.full_name != github.repository
+        uses: reactiveui/actions-common/.github/workflows/workflow-common-sonarcloud-fork.yml@main
+        with:
+            srcFolder: src
+            solutionFile: Refit.slnx
+            minverMinimumMajorMinor: '10.2'
+            sonarProjectKey: reactiveui_refit
+            sonarOrganization: reactiveui
+            sonarExclusions: '**/tests/**,**/benchmarks/**,**/examples/**,**/TestResults/**'
+            sonarCoverageExclusions: '**/tests/**,**/benchmarks/**,**/examples/**,**/*Tests/**,**/*Tests.cs,**/Generated/**,**/*.g.cs'
+            sonarCpdExclusions: '**/tests/**,**/benchmarks/**,**/examples/**'
+            sonarTestExclusions: '**/tests/**,**/benchmarks/**,**/examples/**'
+            testTimeout: '15m'
+        secrets:
+            SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}