test.yml

name: 'Tests & Coverage'
on:
  workflow_dispatch:
  push:
    branches: ['master']
  pull_request:
    branches: ['master']
    types: ['opened', 'reopened', 'synchronize']

permissions:
  contents: read

jobs:
  build:
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull-requests: read  # for sonarsource/sonarcloud-github-action to determine which PR to decorate
    name: 'Tests & Coverage'
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      
      - name: SonarCloud Scan
        uses: sonarsource/sonarcloud-github-action@ba3875ecf642b2129de2b589510c81a8b53dbf4e # master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}