name: SonarQube Analysis

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:

jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install backend deps
        run: npm install
        working-directory: backend

      - name: Install frontend deps
        run: npm install
        working-directory: frontend

      - name: TypeScript build check (backend)
        run: npm run build
        working-directory: backend

      - name: TypeScript build check (frontend)
        run: npm run build
        working-directory: frontend

      # frontend/tsconfig.sonar.json is a standalone copy that cannot use
      # `extends`, so it can drift. Drift does not fail the scan — it silently
      # returns to skipping the frontend while still reporting success, which is
      # the failure #67 was about. Checked before scanning, so the scan is never
      # the thing that discovers it.
      - name: Check the Sonar tsconfig has not drifted
        run: node scripts/check-sonar-tsconfig.js

      # Scan settings live in sonar-project.properties at the repo root, so a
      # local scan and this one analyse the same thing. Only the host and token
      # come from secrets.
      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@v4
        env:
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}