Remove fromJSON from sonar action (#1070)

Signed-off-by: Fiachra Corcoran <fiachra.corcoran@est.tech>

Author: efiacor

.github/workflows/sonarcloud.yml

@@ -62,20 +62,33 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # Use SHA for checkout — immune to branch-name injection
+      - name: Extract PR metadata
+        if: github.event.workflow_run.event == 'pull_request'
+        id: pr_meta
+        env:
+          PR_DATA: ${{ steps.get_pr_data.outputs.data }}
+        run: |
+          echo "number=$(echo "$PR_DATA" | jq -r '.number')" >> "$GITHUB_OUTPUT"
+          echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> "$GITHUB_OUTPUT"
+          echo "base_ref=$(echo "$PR_DATA" | jq -r '.base.ref')" >> "$GITHUB_OUTPUT"
+
+      # Use SHA for checkout — immune to branch-name injection.
+      # allow-unsafe-pr-checkout is safe here: we only scan (no script execution
+      # from fork code) and persist-credentials is false.
       - name: Checkout PR head
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.event.workflow_run.head_repository.full_name }}
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
           persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       # Branch names passed via env (not expression interpolation in run:)
       - name: Checkout base branch
         if: github.event.workflow_run.event == 'pull_request'
         env:
-          BASE_REF: ${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}
+          BASE_REF: ${{ steps.pr_meta.outputs.base_ref }}
           HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
           CLONE_URL: ${{ github.event.repository.clone_url }}
         run: |
@@ -107,9 +120,9 @@ jobs:
             -Dsonar.projectKey=kptdev_porch
             -Dsonar.organization=kptdev
             -Dproject.settings=sonar-project.properties
-            -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }}
-            -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }}
-            -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}
+            -Dsonar.pullrequest.key=${{ steps.pr_meta.outputs.number }}
+            -Dsonar.pullrequest.branch=${{ steps.pr_meta.outputs.head_ref }}
+            -Dsonar.pullrequest.base=${{ steps.pr_meta.outputs.base_ref }}
 
       - name: SonarCloud Scan on push
         if: >-