From 00eb0be74e97339d11d826a9f54561a066a8c52e Mon Sep 17 00:00:00 2001
From: "Robert Kent Jr." <mrrobertkent@gmail.com>
Date: Thu, 8 Oct 2026 16:18:18 -0400
Subject: [PATCH 1/2] SonarQube Cloud: CI-based analysis with Go coverage

---
 .github/workflows/ci.yml | 18 ++++++++++++++++++
 README.md                |  1 +
 sonar-project.properties |  7 +++++++
 3 files changed, 26 insertions(+)
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa2143e..946e3d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,6 +69,24 @@ jobs:
         with:
           version: v2.14.0
 
+  sonar:
+    runs-on: ubuntu-latest
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}   # empty on fork pull requests; the scan is skipped there
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Test with coverage
+        if: env.SONAR_TOKEN != ''
+        run: go test -count=1 -coverprofile=coverage.out ./...
+      - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        if: env.SONAR_TOKEN != ''
+
   govulncheck:
     runs-on: ubuntu-latest
     steps:
diff --git a/README.md b/README.md
index 91cff3f..8fd9200 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,7 @@ hookgate is a lightweight webhook gateway: a single static binary that checks ea
 [![Release](https://img.shields.io/github/v/release/mrrobertkent/hookgate)](https://github.com/mrrobertkent/hookgate/releases/latest)
 [![Go Reference](https://pkg.go.dev/badge/github.com/mrrobertkent/hookgate.svg)](https://pkg.go.dev/github.com/mrrobertkent/hookgate)
 [![License](https://img.shields.io/github/license/mrrobertkent/hookgate)](LICENSE)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=mrrobertkent_hookgate&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=mrrobertkent_hookgate)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/mrrobertkent/hookgate/badge)](https://scorecard.dev/viewer/?uri=github.com/mrrobertkent/hookgate)
 [![Container](https://img.shields.io/badge/ghcr.io-mrrobertkent%2Fhookgate-blue?logo=docker)](https://github.com/mrrobertkent/hookgate/pkgs/container/hookgate)
 
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..a93895d
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,7 @@
+sonar.organization=mrrobertkent
+sonar.projectKey=mrrobertkent_hookgate
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=**/*_test.go
+sonar.exclusions=dist/**
+sonar.go.coverage.reportPaths=coverage.out

From 98b523d0f03a4d15ddc8b25a6301eaf2dbb3c1bd Mon Sep 17 00:00:00 2001
From: "Robert Kent Jr." <mrrobertkent@gmail.com>
Date: Thu, 8 Oct 2026 16:27:24 -0400
Subject: [PATCH 2/2] sonar: scope the token to the scan step; keep tests out
 of main sources

---
 .github/workflows/ci.yml | 8 +++++---
 sonar-project.properties | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 946e3d8..744d785 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
   sonar:
     runs-on: ubuntu-latest
     env:
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}   # empty on fork pull requests; the scan is skipped there
+      HAS_SONAR_TOKEN: ${{ secrets.SONAR_TOKEN != '' }}   # false on fork pull requests; the scan is skipped there
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -82,10 +82,12 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Test with coverage
-        if: env.SONAR_TOKEN != ''
+        if: env.HAS_SONAR_TOKEN == 'true'
         run: go test -count=1 -coverprofile=coverage.out ./...
       - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
-        if: env.SONAR_TOKEN != ''
+        if: env.HAS_SONAR_TOKEN == 'true'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
   govulncheck:
     runs-on: ubuntu-latest
diff --git a/sonar-project.properties b/sonar-project.properties
index a93895d..f1ee50b 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -3,5 +3,5 @@ sonar.projectKey=mrrobertkent_hookgate
 sonar.sources=.
 sonar.tests=.
 sonar.test.inclusions=**/*_test.go
-sonar.exclusions=dist/**
+sonar.exclusions=dist/**,**/*_test.go
 sonar.go.coverage.reportPaths=coverage.out