[kattu-370]Update Sonar Analysis step in workflow

[Mahesh-Binayak]

Summary by CodeRabbit

• Chores
  • Updated the SonarCloud analysis workflow to use the Maven Sonar profile and explicit scanner plugin.
  • Preserved existing project configuration, authentication, and Maven settings during analysis.
  • Improved workflow step labeling and command structure.

[coderabbitai]

Walkthrough

The SonarCloud GitHub Actions step was renamed and its Maven command was updated to use the sonar profile with an explicit plugin coordinate. Existing project properties, authentication, settings, and computed names remain unchanged.

Changes

SonarCloud workflow

Layer / File(s)	Summary
Update Maven SonarCloud execution .github/workflows/maven-sonar-analysis-new.yml	The workflow changes the step label, enters the configured service directory, and invokes the Sonar Maven plugin through the sonar profile while preserving existing SonarCloud properties and Maven settings.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mosip/kattu#336: Modifies the same SonarCloud workflow script and computed project identifiers.
• mosip/kattu#345: Updates GitHub Actions Sonar analysis configuration and execution commands.

Suggested reviewers: ckm007

Poem

Maven steps into the sonar light,
A profile guides the scan just right.
Project keys and tokens stay,
Settings lead the build’s way.
One concise command takes flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: updating the Sonar Analysis workflow step.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maven-sonar-analysis-new.yml:
- Line 65: Update the Maven command’s directory selection to use the GitHub
Actions fallback expression `${{ inputs.SERVICE_LOCATION || '.' }}` instead of
the raw `inputs.SERVICE_LOCATION`, preserving the intended current-directory
behavior when the service location is empty.
- Around line 62-65: Prevent shell injection in the workflow command by passing
SERVICE_LOCATION and SONAR_URL through the step’s env block instead of
interpolating them directly into run. Update the SERVICE_KEY and cd logic to use
the environment variable with strict quoting, and validate that the service path
is relative, contains no traversal or shell metacharacters, and resolves within
the workspace before changing directories. Use the environment-backed SONAR_URL
in the Maven arguments, preserving the existing project-key and token behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 099575b0-602e-4222-bc70-57d42f4d78a8

📥 Commits

Reviewing files that changed from the base of the PR and between ebf2f50 and 50d2fa1.

📒 Files selected for processing (1)

• .github/workflows/maven-sonar-analysis-new.yml