name: SonarCloud

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: sonarcloud-${{ github.ref }}
  # A push to main is the run that publishes coverage; superseded runs there would never finish.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  sonarcloud:
    # Pin the coverage setup that provisions test data and fetches locked dependencies before offline metadata tests.
    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@5008f8cd1b011b35eed223a7d058d7a8e9075ef6
    with:
      # The shared coverage archive's shards omit the CLI executable used by integration tests.
      # Run this repository's suite in one instrumented job and provide its pinned test data.
      shards: 1
      fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69
    secrets: inherit