From aaf1c728cd00fd4bf64b326ef39da3de2e390348 Mon Sep 17 00:00:00 2001
From: Ross Wintle <rosswintle@users.noreply.github.com>
Date: Wed, 30 Sep 2026 12:18:41 +0100
Subject: [PATCH] chore: add SonarQube config

---
 .github/workflows/sonar.yaml | 31 +++++++++++++++++++++++++++++++
 sonar-project.properties     | 21 +++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 .github/workflows/sonar.yaml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
new file mode 100644
index 0000000..29912e8
--- /dev/null
+++ b/.github/workflows/sonar.yaml
@@ -0,0 +1,31 @@
+on:
+  # Trigger analysis for pushes and pull requests
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+name: SonarQube Main Workflow
+jobs:
+  sonarqube:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Fetch full history for better SCM information
+          fetch-depth: 0
+
+      - name: Run SonarQube Scan
+        uses: sonarsource/sonarqube-scan-action@master # @master tag vs. commit hash is the prescribed pattern by our security team for sonarsource/
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+
+      - name: Quality Gate Check
+        uses: sonarsource/sonarqube-quality-gate-action@master # @master tag vs. commit hash is the prescribed pattern by our security team for sonarsource/
+        timeout-minutes: 5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..2e8f5ed
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,21 @@
+# Server and project configuration
+# Note: SONAR_HOST_URL is also passed at scan time. This entry documents the
+# expected host and is a no-op when the runtime value takes precedence.
+sonar.host.url=https://sonar.wpengine.io/
+sonar.projectVersion=1.0
+sonar.sourceEncoding=UTF-8
+sonar.scm.provider=git
+
+# Project identifiers
+sonar.projectName=wp-background-processing
+sonar.projectKey=deliciousbrains_wp-background-processing_bf303ad2-c3ca-452d-aadc-0777a554842b
+
+# Paths to source code directories (relative paths)
+sonar.sources=classes,wp-background-processing.php
+
+# Exclusions — derive from sonar.test.inclusions patterns + language-specific vendor dirs
+sonar.exclusions=tests/**,vendor/**
+
+# Paths to test code directories (relative paths)
+sonar.tests=.
+sonar.test.inclusions=tests/**