Files

44 lines
1.6 KiB
Markdown

# sonarqube-dotnet
Reusable Gitea Actions workflow: runs a SonarQube analysis for a .NET project. The steps are `dotnet sonarscanner begin`, then the build command, then `end`.
## Usage
```yaml
jobs:
sonar:
uses: templates/sonarqube-dotnet/.gitea/workflows/sonarqube-dotnet.yaml@v1
with:
sonar-project-key: my-project
# working-directory: .
# dotnet-version: 10.0.x
# build-command: dotnet build
secrets:
SONAR_HOST: ${{ secrets.SONAR_HOST }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
```
## Inputs / secrets
| Name | Required | Default | Description |
|---|---|---|---|
| `sonar-project-key` | yes | | SonarQube project key (`/k:`) |
| `working-directory` | no | `.` | Where the build runs |
| `dotnet-version` | no | `10.0.x` | .NET SDK version |
| `build-command` | no | `dotnet build` | Build command between begin/end |
| secret `SONAR_HOST` | yes | | SonarQube server URL |
| secret `SONAR_TOKEN` | yes | | SonarQube token |
## Versioning
Only major tags (`v1`, `v2`, …). Fixes move the existing tag. Changing inputs or secrets needs a new major tag.
History before the move: [UltimateCoder/resuable-workflows](https://git.custom-coding.net/UltimateCoder/resuable-workflows).
## Entscheidungen
Decisions by the owner of the `templates` org:
- 2026-10-15: Only major tags (`v1`, `v2`, …), no `vX.Y.Z` tags (see Versioning).
- 2026-10-17: All repos in the `templates` org are public, so consumers' runners can fetch them without credentials. They never contain secrets or internal addresses: secrets come in as `secrets:`, hosts as inputs.