Add SonarQube analysis and coverage reporting to GitHub Actions

.github/workflows/maven_unit_test.yml

@@ -147,7 +147,7 @@
           # Get the build output from the integration test job
           - uses: actions/download-artifact@v8
             with:
-                name: java-reportdir
+              name: java-reportdir
           - run: tar -xvf java-reportdir.tar
 
           # Deposit Code Coverage
@@ -162,7 +162,41 @@
                 -DrepoToken=${COVERALLS_SECRET} -DpullRequest=${{ github.event.number }}
                 jacoco:report coveralls:report
 
-          # NOTE: this may be extended with adding a report to the build output, leave a comment, send to Sonarcloud, ...
+    sonarcloud:
+      runs-on: ubuntu-latest
+      needs: integration-test
+      name: SonarQube Analysis and Coverage
+      steps:
+        # TODO: As part of #10618 change to setup-maven custom action
+        # Basic setup chores
+        - uses: actions/checkout@v7
+          with:
+            # Sonarcube benefits from a full Git history in it's analysis (assign issues, etc)
+            fetch-depth: 0
+        - uses: actions/setup-java@v5
+          with:
+            java-version: '21'
+            distribution: temurin
+            cache: maven
+
+        # Get the coverage output from the integration test job
+        - uses: actions/download-artifact@v8
+          with:
+            name: java-reportdir
+        # Get the binary class files as Sonar needs them for analysis
+        - uses: actions/download-artifact@v8
+          with:
+            name: java-artifacts
+        - run: |
+            tar -xvf java-builddir.tar
+            tar -xvf java-reportdir.tar
+
+        # Run Sonarcube analysis
+        - name: Analyze and commit to SonarCloud
+          env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+            SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          run: mvn -B org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
 
     # TODO: Add a filter step here, that avoids calling the app image release workflow if there are changes to the base image.
     #       Use https://github.com/dorny/paths-filter to solve this. Will require and additional job or adding to integration-test job.

modules/dataverse-parent/pom.xml

@@ -173,7 +173,6 @@
         <smallrye-mpconfig.version>3.7.1</smallrye-mpconfig.version>
         <junit.jupiter.version>5.10.2</junit.jupiter.version>
         <mockito.version>5.11.0</mockito.version>
-        <maven-jacoco-plugin.version>0.8.11</maven-jacoco-plugin.version>
 
         <checkstyle.version>9.3</checkstyle.version>
 
@@ -198,9 +197,18 @@
         <maven-checkstyle-plugin.version>3.2.2</maven-checkstyle-plugin.version>
         <nexus-staging-plugin.version>1.6.13</nexus-staging-plugin.version>
         <pomchecker-maven-plugin.version>1.7.0</pomchecker-maven-plugin.version>
+        <sonar.version>5.7.0.6970</sonar.version>
+        <maven-jacoco-plugin.version>0.8.14</maven-jacoco-plugin.version>
 
         <!-- Container related -->
         <fabric8-dmp.version>0.48.0</fabric8-dmp.version>
+
+        <!-- SonarQube Code Quality related -->
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+        <sonar.organization>iqss</sonar.organization>
+        <sonar.projectKey>IQSS_dataverse</sonar.projectKey>
+        <sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
+        <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>   
     </properties>
 
     <pluginRepositories>
@@ -318,6 +326,11 @@
                     <artifactId>pomchecker-maven-plugin</artifactId>
                     <version>${pomchecker-maven-plugin.version}</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.sonarsource.scanner.maven</groupId>
+                    <artifactId>sonar-maven-plugin</artifactId>
+                    <version>${sonar.version}</version>
+                </plugin>
                 <plugin>
                     <groupId>org.sonatype.plugins</groupId>
                     <artifactId>nexus-staging-maven-plugin</artifactId>

pom.xml

@@ -26,6 +26,9 @@
         <surefire.jacoco.args>-Ddummy.jacoco.property=true</surefire.jacoco.args>
         <failsafe.jacoco.args>-Ddummy.jacoco.property=true</failsafe.jacoco.args>
 
+        <jacoco.merged.outputdir>${project.reporting.outputDirectory}/jacoco-merged-test-coverage-report</jacoco.merged.outputdir>
+        <sonar.coverage.jacoco.xmlReportPaths>${jacoco.merged.outputdir}/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
+
         <!-- By default, this module will produce a WAR file. -->
         <!-- This will be switched within the container profile! -->
         <packaging.type>war</packaging.type>
@@ -1031,7 +1034,7 @@
                         </goals>
                         <configuration>
                             <dataFile>${project.build.directory}/coverage-reports/merged.exec</dataFile>
-                            <outputDirectory>${project.reporting.outputDirectory}/jacoco-merged-test-coverage-report</outputDirectory>
+                            <outputDirectory>${jacoco.merged.outputdir}</outputDirectory>
                             <skip>${skipIntegrationTests}</skip>
                         </configuration>
                     </execution>