[KATTU-334]Update sonar workflow in develop.

[Mahesh-Binayak]

Removed unnecessary inputs and environmental variables for Android location and organization. Updated Sonar analysis command to use secrets and simplified the workflow.

Summary by CodeRabbit

• Chores
  • Streamlined continuous integration workflow configuration to reduce setup complexity
  • Enhanced build performance with optimized caching for code quality analysis
  • Updated code quality scanning execution for improved efficiency

[coderabbitai]

Walkthrough

The reusable gradlew-sonar-analysis.yml workflow is simplified: its workflow_call interface now uses SERVICE_LOCATION, optional SONAR_URL/SONAR_ARGS inputs, and ORG_KEY as the required secret. The Node.js setup step is removed, a SonarCloud cache step is added, env validation is updated, and the Gradle analysis command is rewritten to derive Sonar project keys from ORG_KEY and the repository name.

Changes

Gradle Sonar Analysis Workflow Refactor

Layer / File(s)	Summary
Workflow contract: inputs, secrets, and env .github/workflows/gradlew-sonar-analysis.yml	Reduces workflow_call inputs to SERVICE_LOCATION, SONAR_URL, and SONAR_ARGS; replaces SONAR_ORGANIZATION with ORG_KEY as the required secret; removes Android/project-related env variables, keeping only GITHUB_TOKEN and SONAR_TOKEN.
Step changes: cache, env validation, and analysis command .github/workflows/gradlew-sonar-analysis.yml	Removes Node.js setup step; adds a SonarCloud artifact cache step for ~/.sonar/cache; updates the env-check script to validate SONAR_TOKEN and ORG_KEY; rewrites the analysis step to chmod and invoke ./gradlew build sonarqube from SERVICE_LOCATION with Sonar properties derived from ORG_KEY and the repository name.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 A workflow once tangled with nodes and old keys,
Now hops through the cache with remarkable ease.
ORG_KEY in paw, the repo name in tow,
./gradlew sonarqube — watch the analysis go!
Less config to carry, more sonar to scan,
A tidier burrow, as per the new plan. 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title references the main change (updating the Sonar workflow) and includes a ticket identifier, making it relevant to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/gradlew-sonar-analysis.yml:
- Around line 18-21: The workflow file now declares ORG_KEY as the required
secret (line 21), but the documentation in docs/gradlew-sonar-analysis-readme.md
still references the old SONAR_ORGANIZATION secret name at lines 23-24. Update
the documentation file to replace all occurrences of SONAR_ORGANIZATION with
ORG_KEY to ensure consistency between the workflow contract and the setup
instructions provided to users.
- Around line 73-81: The `run` script in the gradlew-sonar-analysis workflow
directly expands user inputs like `inputs.SERVICE_LOCATION` and
`inputs.SONAR_ARGS` without proper quoting or escaping, creating a security
vulnerability. Move the inputs into environment variables first using the `env`
section at the beginning of the `run` block, then reference them with proper
double quotes throughout the script (e.g., `"$SERVICE_LOCATION"` and
`$SONAR_ARGS`) to prevent shell injection and command expansion attacks.
- Around line 57-63: The validation block checks for SONAR_TOKEN and ORG_KEY but
does not validate SONAR_URL, which is used later in the same step. Add a
conditional check for the SONAR_URL input (using inputs.SONAR_URL) in the
validation block alongside the existing SONAR_TOKEN and ORG_KEY checks,
following the same pattern with an if statement that echoes an error message and
exits with code 1 if the value is empty.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2ad0d7a2-fb10-42b1-ad90-a487aac3e330

📥 Commits

Reviewing files that changed from the base of the PR and between 1247b12 and d7c5a15.

📒 Files selected for processing (1)

• .github/workflows/gradlew-sonar-analysis.yml