From ea5fdca35ce9d39fc38ffe7d325f1b6faf633722 Mon Sep 17 00:00:00 2001
From: Claude Code <claude@siax.io>
Date: Mon, 28 Sep 2026 01:25:18 +0200
Subject: [PATCH] =?UTF-8?q?chore(ci):=20koppla=20in=20SonarQube-analys=20m?=
 =?UTF-8?q?ot=20sj=C3=A4lvhostad=20sonar.siax.io?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Repo: c0py. Lägger till sonar-project.properties (projectKey=c0py) och
en ny sonar-job i .gitea/workflows/ci.yml som kör sonar-scanner mot
sonar.siax.io vid push till main (Community Build saknar PR-analysläge).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml  | 27 +++++++++++++++++++++++++++
 sonar-project.properties |  5 +++++
 2 files changed, 32 insertions(+)
 create mode 100644 sonar-project.properties

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 74503be..0f9b253 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -51,3 +51,30 @@ jobs:
         run: pnpm run validate:architecture
       - name: Check schema/contracts and provenance policy
         run: pnpm --filter @siax/c0py-core test
+  sonar:
+    # SonarQube Community Build har inget separat PR-analysläge (en enda "main"-gren
+    # per projekt) — en analys från en PR-branch eller en tagg-push som inte pekar på
+    # main skulle skriva över kvalitetshistoriken. Kör därför bara
+    # vid push till main.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: SonarQube analysis (self-hosted sonar.siax.io)
+        env:
+          SONAR_HOST_URL: https://sonar.siax.io
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "$SONAR_TOKEN" || { echo "::error::SONAR_TOKEN repo secret missing"; exit 1; }
+          # Jobbet kör i en container på act_runner; "docker run -v \"$PWD:...\""
+          # skulle montera VÄRDENS (tomma) sökväg. Kopiera in källträdet istället.
+          cid=$(docker create -e SONAR_HOST_URL -e SONAR_TOKEN -w /usr/src \
+            sonarsource/sonar-scanner-cli:latest \
+            sonar-scanner -Dsonar.projectKey=c0py -Dsonar.host.url="$SONAR_HOST_URL")
+          trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
+          docker cp . "$cid":/usr/src
+          docker start -a "$cid"
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..b2ffde3
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,5 @@
+sonar.projectKey=c0py
+sonar.host.url=https://sonar.siax.io
+sonar.sources=apps/api/src,apps/web/src,packages/c0py-core/src,packages/config/src,packages/types/src
+sonar.tests=apps/api/tests,apps/web/tests,packages/c0py-core/tests,packages/config/tests,packages/types/tests
+sonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/.next/**,**/coverage/**,**/__pycache__/**,**/*.min.js