code-npm_node-sonarcloud-analysis.yml

# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0
---
name: code-npm-sonarcloud-analysis
run-name: SonarCloud analysis on ${{ github.head_ref || github.ref_name }} branch

concurrency:
  group: sonarcloud-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: ["develop", "develop-*", "main", "main-*"]
    paths:
      - "package.json"
      - "package-lock.json"
      - ".tool-versions"
      - "src/**"
      - "types/**"
      - "example/**"
      - ".github/workflows/code-*-sonarcloud-analysis.yml"
  release:
    types:
      - published

env:
  ASDF_BRANCH_VERSION: 0.18.0

jobs:
  unit-tests:
    name: SonarCloud / Unit Tests
    permissions:
      contents: read
    timeout-minutes: 30
    if: >-
      ${{
        (github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' || github.event_name == 'release')
        && vars.IS_INDITEXTECH_REPO == 'true'
        && vars.SONARCLOUD_ENABLED == 'true'
      }}
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Detect NPM project
        id: project
        run: |
          if [ -f package.json ]; then
            echo "has-package=true" >> "$GITHUB_OUTPUT"
          else
            echo "::notice::package.json is not present yet; skipping SonarCloud analysis for the OSS shell PR."
            echo "has-package=false" >> "$GITHUB_OUTPUT"
          fi

      - name: NPM / Setup Dependencies Cache
        if: steps.project.outputs.has-package == 'true'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: asdf / Setup Dependencies Cache
        if: steps.project.outputs.has-package == 'true'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        id: asdf-cache
        with:
          path: ~/.asdf
          key: ${{ runner.os }}-asdf-${{ env.ASDF_BRANCH_VERSION }}-${{ hashFiles('.tool-versions') }}

      - name: Save tool-versions content
        if: steps.project.outputs.has-package == 'true'
        run: |
          {
            echo "TOOL_VERSIONS<<EOF"
            cat .tool-versions
            echo "EOF"
          } >> "$GITHUB_ENV"

      - name: NPM / Setup asdf environment
        if: steps.project.outputs.has-package == 'true' && steps.asdf-cache.outputs.cache-hit != 'true'
        uses: asdf-vm/actions/install@1902764435ca0dd2f3388eea723a4f92a4eb8302 # v4.0.0
        with:
          tool_versions: ${{ env.TOOL_VERSIONS }}
          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}

      - name: Restore asdf shims to PATH
        if: steps.project.outputs.has-package == 'true' && steps.asdf-cache.outputs.cache-hit == 'true'
        run: |
          echo "$HOME/.asdf/bin" >> "$GITHUB_PATH"
          echo "$HOME/.asdf/shims" >> "$GITHUB_PATH"
          cp .tool-versions "$HOME/.tool-versions"

      - name: NPM / Install dependencies
        if: steps.project.outputs.has-package == 'true'
        run: npm ci

      - name: NPM / Build package
        if: steps.project.outputs.has-package == 'true'
        run: npm run build --if-present

      - name: NPM / Run unit tests with coverage
        if: steps.project.outputs.has-package == 'true'
        continue-on-error: true
        run: npm run test:coverage --if-present

      - name: Store project information
        if: steps.project.outputs.has-package == 'true'
        id: version
        run: |
          echo "app-version=$(jq -r '.version' package.json)" >> "$GITHUB_OUTPUT"
          echo "app-name=$(jq -r '.name' package.json)" >> "$GITHUB_OUTPUT"
          echo "github-repository=$(echo "$GITHUB_REPOSITORY" | cut -d'/' -f2)" >> "$GITHUB_OUTPUT"

      - name: Set up JDK 21 for SonarScanner
        if: steps.project.outputs.has-package == 'true'
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"

      - name: SonarCloud / Run analysis with release event
        if: ${{ steps.project.outputs.has-package == 'true' && github.event_name == 'release' }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          npx sonar-scanner \
            -Dsonar.host.url="https://sonarcloud.io/" \
            -Dsonar.organization=inditextech \
            -Dsonar.projectKey=InditexTech_"${{ steps.version.outputs.github-repository }}" \
            -Dsonar.projectName="${{ steps.version.outputs.github-repository }}" \
            -Dsonar.projectVersion="${{ github.event.release.tag_name }}" \
            -Dsonar.branch.name="release/${{ github.event.release.tag_name }}" \
            -Dsonar.sources=src \
            -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info

      - name: SonarCloud / Run analysis
        if: ${{ steps.project.outputs.has-package == 'true' && github.event_name != 'release' }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            SCOPE_OPTIONS="-Dsonar.pullrequest.key=${{ github.event.pull_request.number }} -Dsonar.pullrequest.branch=${{ github.head_ref }} -Dsonar.pullrequest.base=${{ github.base_ref }}"
          else
            SCOPE_OPTIONS="-Dsonar.branch.name=${{ github.ref_name }}"
          fi

          npx sonar-scanner \
            -Dsonar.host.url="https://sonarcloud.io/" \
            -Dsonar.organization=inditextech \
            -Dsonar.projectKey=InditexTech_"${{ steps.version.outputs.github-repository }}" \
            -Dsonar.projectName="${{ steps.version.outputs.github-repository }}" \
            -Dsonar.projectVersion="${{ steps.version.outputs.app-version }}" \
            -Dsonar.sources=src \
            -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info \
            $SCOPE_OPTIONS