From a791aabd76d3e1c404c5806e7c52cd0747f3b35d Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Thu, 15 Oct 2026 19:14:11 +0000
Subject: [PATCH 1/2] ci: analyze source with SonarQube Cloud

---
 .github/workflows/sonar.yml | 31 +++++++++++++++++++++++++++++++
 README.md                   |  2 ++
 sonar-project.properties    | 12 ++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 .github/workflows/sonar.yml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 0000000..8aad74c
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,31 @@
+name: SonarQube
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonar-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analysis:
+    name: SonarQube analysis
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: -Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=300
diff --git a/README.md b/README.md
index b718212..ac72cb6 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # Durable Workflow CLI
 
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=durable-workflow_cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=durable-workflow_cli)
+
 <p align="center">
   <a href="https://github.com/durable-workflow/cli/actions/workflows/build.yml?query=branch%3Amain"><img src="https://github.com/durable-workflow/cli/actions/workflows/build.yml/badge.svg?branch=main" alt="Build status"></a>
   <a href="https://github.com/durable-workflow/cli/releases/latest"><img src="https://img.shields.io/github/v/release/durable-workflow/cli?sort=semver" alt="Latest release"></a>
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..46d6487
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,12 @@
+sonar.organization=durable-workflow
+sonar.projectKey=durable-workflow_cli
+sonar.projectName=cli
+sonar.sourceEncoding=UTF-8
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=tests/**,**/tests/**,**/*.test.*,**/*.spec.*,**/test_*.py,benchmarks/**,scripts/conformance/**
+# Dependencies, generated assets and disposable runtime/build output are not source.
+sonar.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/dist/**,**/build/**,**/storage/**,**/.venv/**,**/__pycache__/**,**/coverage/**,**/.scannerwork/**,**/.git/**,static/vendor/**,public/vendor/**,resources/js/vendor/**
+sonar.test.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/.venv/**
+# Existing repository test and coverage gates remain required; do not fabricate reports.
+sonar.sca.enabled=false

From 8d57dfec9fdb49671adcf7894c38b516bfa45605 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Thu, 15 Oct 2026 19:24:44 +0000
Subject: [PATCH 2/2] ci: keep uncollected coverage distinct from static
 analysis

---
 sonar-project.properties | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sonar-project.properties b/sonar-project.properties
index 46d6487..4762d37 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -8,5 +8,7 @@ sonar.test.inclusions=tests/**,**/tests/**,**/*.test.*,**/*.spec.*,**/test_*.py,
 # Dependencies, generated assets and disposable runtime/build output are not source.
 sonar.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/dist/**,**/build/**,**/storage/**,**/.venv/**,**/__pycache__/**,**/coverage/**,**/.scannerwork/**,**/.git/**,static/vendor/**,public/vendor/**,resources/js/vendor/**
 sonar.test.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/.venv/**
-# Existing repository test and coverage gates remain required; do not fabricate reports.
+# This CI job performs static analysis. Repository test/coverage gates stay required.
+# No coverage report is collected here; leave that metric unmeasured in Sonar.
+sonar.coverage.exclusions=**/*
 sonar.sca.enabled=false