chore(ci): add SonarCloud scan job to the build-test workflow

.circleci/config.yml

@@ -2,6 +2,8 @@ version: 2.1
 
 orbs:
   go: circleci/go@1.10.0
+  # Pinned exactly, matching Open-MBEE/flexo-mms-layer1-service.
+  sonarcloud: sonarsource/sonarcloud@4.0.0
 
 executors:
   go-executor:
@@ -182,6 +184,8 @@ jobs:
           root: .
           paths:
             - bin/sysml-grpc
+            # The scan job reads this profile; without it Sonar shows no coverage.
+            - coverage.txt
 
       - store_artifacts:
           path: bin/
@@ -190,6 +194,54 @@ jobs:
       - store_test_results:
           path: coverage.txt
 
+  # SonarCloud analysis. The `SonarCloud` context supplies SONAR_TOKEN.
+  scan:
+    executor: go-executor
+    steps:
+      # Forked PRs get no context, so the token is absent there: end green
+      # rather than fail every outside contribution. With a token, a failing
+      # scan still fails the job.
+      - run:
+          name: Halt when SONAR_TOKEN is absent (forked PR)
+          command: |
+            if [ -z "${SONAR_TOKEN:-}" ]; then
+              echo "SONAR_TOKEN is empty (forked PR or missing context); skipping the scan."
+              circleci-agent step halt
+            fi
+
+      - checkout
+
+      - attach_workspace:
+          at: .
+
+      # sonar.go.coverage.reportPaths expects the profile at the repo root.
+      - run:
+          name: Show the coverage profile the scan reads
+          command: |
+            ls -l coverage.txt
+            head -n 3 coverage.txt
+
+      # SonarCloud needs full history for blame and new-code detection.
+      - run:
+          name: Fetch full git history
+          command: |
+            if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+              git fetch --unshallow
+            fi
+
+      - sonarcloud/scan
+
+      # SonarCloud does not create a project from a CI scan, so the first run
+      # against an unprovisioned project fails; point at the setup doc.
+      - run:
+          name: Point at the setup doc on failure
+          when: on_fail
+          command: |
+            echo "The scan failed. If it reported \"Could not find a default branch for"
+            echo "project with key 'Open-MBEE_OpenSysML'\", the project has not been"
+            echo "created on SonarCloud yet: see 'The SonarCloud scan' in"
+            echo "docs/project/releasing.md for the one-time maintainer step."
+
   python-test:
     executor: python-executor
     steps:
@@ -688,6 +740,17 @@ workflows:
               only: /.*/
             tags:
               ignore: /.*/
+      - scan:
+          # Matched exactly, like PyPI below; this context holds SONAR_TOKEN.
+          context:
+            - SonarCloud
+          requires:
+            - build-and-test
+          filters:
+            branches:
+              only: /.*/
+            tags:
+              ignore: /.*/
 
   # Build and release on tags. The suite runs here too: a tag can point at any
   # commit, so a release is only published from a revision proven green.

docs/project/releasing.md

@@ -188,6 +188,33 @@ token, `Contents: read` for a fine-grained one; nothing is written through the
 API. Without either variable the script fails immediately with
 `MissingTokenError` naming the variable, rather than at the first request.
 
+## The SonarCloud scan
+
+Not a release step — the `scan` job runs in the `build-test` workflow on every
+commit, after `build-and-test` — but it is documented here with the other
+CircleCI credential plumbing.
+
+The job references the organization context named exactly `SonarCloud`, which
+supplies `SONAR_TOKEN` (the same context `Open-MBEE/flexo-mms-layer1-service`
+uses, so no new credential is provisioned). It reads
+`sonar-project.properties` at the repository root and the `coverage.txt`
+profile that `build-and-test` writes (`go test -coverprofile=coverage.txt`) and
+persists to the workspace, and it un-shallows the clone because SonarCloud
+needs full history for blame and new-code detection.
+
+On a forked PR the context is withheld, so `SONAR_TOKEN` is empty; the job
+halts successfully rather than failing every outside contribution. When the
+token is present, a failing scan fails the job.
+
+One-time maintainer step (already done for `Open-MBEE_OpenSysML`, but true of
+any future project): SonarCloud does not create a project from a CI-run scan
+(the scanner sends branch parameters, and Cloud cannot provision from those —
+the first run fails with `Could not find a default branch for project with key
+'...'`). Create the project under the organization first, either from the
+SonarCloud UI or with `POST api/projects/create` followed by
+`POST api/project_branches/rename`, using a token that has Create Projects in
+that organization.
+
 ## Releasing opensysml to PyPI
 
 The Python client in `python/` is published to PyPI as

sonar-project.properties

@@ -0,0 +1,15 @@
+sonar.projectKey=Open-MBEE_OpenSysML
+sonar.organization=openmbee
+
+# Go sources and tests share directories, so the split is by pattern, not path.
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=**/*_test.go,python/tests/**
+
+# Fixtures, demos, the fetched OMG corpus, and generated code are not
+# hand-written source; scripts/ and .github/ stay in scope on purpose.
+sonar.exclusions=**/*_test.go,**/testdata/**,examples/**,python/tests/**,**/*.pb.go,internal/core/rdf/ontology/table.go
+sonar.test.exclusions=**/testdata/**,examples/**,python/tests/golden/**
+
+# The profile build-and-test already writes and persists to the workspace.
+sonar.go.coverage.reportPaths=coverage.txt