Refactor sonarcloud workflow and remove security issue (#325)

Author: kornys

.github/workflows/sonarcloud.yaml

@@ -1,15 +1,12 @@
-name: SonarQube
+name: SonarCloud
 
 on:
   push:
-    branches: [ main ]
-
+    branches:
+      - main
   pull_request:
-    branches: [ main ]
-
-  pull_request_target:
-    types: [ labeled, opened, synchronize, reopened ]
-    branches: [ main ]
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -19,85 +16,48 @@ env:
   SONAR_PROJECT_KEY: skodjob_test-frame
 
 jobs:
-  sonar-push:
-    if: github.event_name == 'push'
+  analyze:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@v4
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: 17
 
-      - uses: actions/cache@v4
+      - name: Cache Maven packages
+        uses: actions/cache@v4
         with:
-          path: ~/.m2
+          path: ~/.m2/repository
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-m2
 
-      - name: Build & Sonar scan (push)
+      - name: SonarCloud scan on PR
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
           ./mvnw verify \
-              org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-              -Dsonar.projectKey=$SONAR_PROJECT_KEY \
-              -Dsonar.coverage.exclusions="**/*"
-
-  sonar-pr-internal:
-    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - uses: actions/cache@v4
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
+            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
+            -Dsonar.projectKey=$SONAR_PROJECT_KEY
 
-      - name: Build & Sonar scan (internal PR)
+      - name: SonarCloud scan on Push
+        if: github.event_name == 'push'
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
           ./mvnw verify \
-              org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-              -Dsonar.projectKey=$SONAR_PROJECT_KEY
+            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
+            -Dsonar.projectKey=$SONAR_PROJECT_KEY \
+            -Dsonar.coverage.exclusions="**/*"
 
-  sonar-pr-fork:
-    if: |
-      github.event_name == 'pull_request_target' && 
-      github.event.pull_request.head.repo.fork == true &&
-      contains(github.event.pull_request.labels.*.name, 'safe-to-scan')
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-java@v4
-        with: { distribution: temurin, java-version: 17 }
-
-      - name: Sonar scan (fork PR)
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: Comment on fork PRs
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
         run: |
-          ./mvnw verify \
-              org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-              -Dsonar.projectKey=$SONAR_PROJECT_KEY
+          echo "Skipping SonarCloud analysis for forked PRs for security reasons."