code-linting-2.yml

---
# SPDX-FileCopyrightText: none
# SPDX-License-Identifier: CC0-1.0

name: "Code linting 2"
permissions: {}
on:
  push:
    branches:
      - main
jobs:
  codacy:
    name: "Codacy"
    if: "${{ github.repository_owner == 'micro5k' }}"
    runs-on: ubuntu-latest
    concurrency:
      group: "${{ github.repository_id }}-${{ github.workflow }}-codacy"
      cancel-in-progress: false
    permissions:
      security-events: write

    steps:
      - name: "Checkout sources"
        uses: actions/checkout@v4
      - name: "Codacy analysis"
        uses: codacy/codacy-analysis-cli-action@v4
        with:
          project-token: "${{ secrets.CODACY_PROJECT_TOKEN }}"
          #verbose: true
          output: results.sarif
          format: sarif
          # Adjust severity of non-security issues
          gh-code-scanning-compat: true
          # Force 0 exit code to allow SARIF file generation
          # This will hand over control about PR rejection to the GitHub side
          max-allowed-issues: 2147483647
          upload: false
      - name: "Upload SARIF results file"
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "results.sarif"
          category: "Codacy"

  sonarqube:
    name: "SonarQube"
    if: "${{ github.repository_owner == 'micro5k' }}"
    runs-on: ubuntu-latest

    steps:
      - name: "Checkout sources"
        uses: actions/checkout@v4
        with:
          fetch-depth: "0" # Shallow clones should be disabled for a better relevancy of analysis
      - name: "SonarQube scan"
        uses: SonarSource/sonarqube-scan-action@v4
        env:
          SONAR_TOKEN: "${{ secrets.SONAR_TOKEN }}"