Configure SonarQube analysis in CI

.github/workflows/build.yml

@@ -1,6 +1,7 @@
 name: Build
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
   pull_request:
@@ -17,6 +18,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
 
       - name: Set up Java
         uses: actions/setup-java@v4
@@ -27,5 +30,23 @@ jobs:
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      - name: Cache SonarQube packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
       - name: Build and test
         run: ./gradlew build
+
+      - name: SonarQube analysis
+        # Analysis is advisory: a failed or unconfigured scan must not fail the build.
+        continue-on-error: true
+        # SONAR_PROJECT_KEY is a repository variable holding the key SonarQube
+        # assigned when this repo was imported via the GitHub App.
+        if: ${{ vars.SONAR_PROJECT_KEY != '' }}
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+        run: ./gradlew sonar --info -Dsonar.projectKey=${{ vars.SONAR_PROJECT_KEY }}

build.gradle

@@ -1,5 +1,13 @@
 plugins {
     id 'application'
+    id "org.sonarqube" version "7.3.1.8318"
+}
+
+sonar {
+  properties {
+    property "sonar.projectName", "deprecated-java-api-demo-5"
+    property "sonar.links.scm", "https://github.com/sourcegraph-testing/deprecated-java-api-demo-5"
+  }
 }
 
 group = 'dev.trly.java.example.primitive.wrappers'