SC-32488 Add sq analysis (#67)

* SC-32488 Add sq analysis

* SC-32488 Fix analysis issues

.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: CI
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_call:
+
+jobs:
+  run-unit-tests:
+    uses: ./.github/workflows/unit-tests.yml
+  run-sqc-eu-analysis:
+    needs: run-unit-tests
+    uses: ./.github/workflows/sonar-scan.yml
+    with:
+      platform_name: "SQC-EU"
+      host_url: "https://sonarcloud.io"
+      vault_path: "development/kv/data/sonarcloud"
+    permissions:
+      id-token: write
+      contents: read

.github/workflows/sonar-scan.yml

@@ -0,0 +1,46 @@
+name: SonarQube Scan
+on:
+  workflow_call:
+    inputs:
+      platform_name:
+        description: 'Platform name (e.g., Next, SQC-EU, SQC-US)'
+        required: true
+        type: string
+      host_url:
+        description: 'SonarQube Server/Cloud host URL'
+        required: true
+        type: string
+      vault_path:
+        description: 'Vault path to retrieve the Sonar token'
+        required: true
+        type: string
+
+jobs:
+  sonar-scan:
+    name: Run ${{ inputs.platform_name }} Analysis
+    runs-on: github-ubuntu-latest-s
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+      - name: Vault
+        id: secrets
+        uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # 3.1.0
+        with:
+          secrets: |
+            ${{ inputs.vault_path }} token | SONAR_TOKEN;
+      - name: Run SonarQube Analysis
+        uses: SonarSource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ inputs.host_url }}
+        with:
+          args: >
+            -Dsonar.projectKey=SonarSource_sonarqube-quality-gate-action
+            -Dsonar.organization=sonarsource
+            -Dsonar.sources=script
+            -Dsonar.sourceEncoding=UTF-8
+            -Dsonar.sca.enabled=false

.github/workflows/unified-dogfooding.yml

@@ -0,0 +1,56 @@
+name: Unified Dogfooding scans
+on:
+  schedule:
+    - cron: '0 4 * * 1' # Run weekly on Monday at 04:00 UTC
+  workflow_dispatch:
+
+jobs:
+  run-ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      id-token: write
+      contents: read
+
+  run-next-analysis:
+    name: Next Scan
+    needs: run-ci
+    uses: ./.github/workflows/sonar-scan.yml
+    with:
+      platform_name: "Next"
+      host_url: "https://next.sonarqube.com/sonarqube"
+      vault_path: "development/kv/data/next"
+    permissions:
+      id-token: write
+      contents: read
+
+  run-sqc-us-analysis:
+    name: SQC US Scan
+    needs: run-ci
+    uses: ./.github/workflows/sonar-scan.yml
+    with:
+      platform_name: "SQC-US"
+      host_url: "https://sonarqube.us"
+      vault_path: "development/kv/data/sonarqube-us"
+    permissions:
+      id-token: write
+      contents: read
+
+  run-iris:
+    name: IRIS
+    needs: [run-ci, run-next-analysis, run-sqc-us-analysis]
+    runs-on: github-ubuntu-latest-s
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Run IRIS Analysis
+        uses: SonarSource/unified-dogfooding-actions/run-iris@v1
+        with:
+          primary_project_key: SonarSource_sonarqube-quality-gate-action
+          primary_platform: "SQC-EU"
+          shadow1_project_key: SonarSource_sonarqube-quality-gate-action
+          shadow1_platform: "Next"
+          shadow2_project_key: SonarSource_sonarqube-quality-gate-action
+          shadow2_platform: "SQC-US"

.github/workflows/unit-tests.yml

@@ -1,21 +1,19 @@
-name: QA
+name: Unit Tests
 on:
-  push:
-    branches:
-      - master
-  pull_request:
-    types: [opened, synchronize, reopened]
+  workflow_call:
+
 jobs:
   run-unit-tests:
+    name: Run Unit Tests
     runs-on: github-ubuntu-latest-s
     steps:
       - name: checkout action
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: main
           fetch-depth: 0
       - name: checkout bats-core
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: bats-core
           repository: bats-core/bats-core