code-quality.yml

name: 📊 Code Quality

on:
  workflow_dispatch:
  pull_request:
    branches: [main]
  push:
    branches:
      - main
      - "releases/*"

jobs:
  # Qodana Analysis
  qodana:
    name: 🔍 Qodana Analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      checks: write

    steps:
      - name: 📥 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: 🔍 Qodana Scan
        id: qodana
        uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891
        continue-on-error: true
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
        with:
          args: --linter,qodana-cdnet --project,QRCoder.Core/QRCoder.Core.csproj --baseline,qodana.sarif.json --fail-threshold,0
          cache-default-branch-only: true
          upload-result: false
          primary-cache-key: qodana-2025.3-refs/heads/main-${{ github.sha }}
          additional-cache-key: qodana-2025.3-refs/heads/main

      - name: 📊 Upload Qodana Results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        if: always()
        with:
          name: qodana-report
          path: ${{ github.workspace }}/qodana

  # SonarQube Analysis
  sonarqube:
    name: 📊 SonarQube Analysis
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    permissions:
      contents: read

    steps:
      - name: 📥 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          fetch-depth: 0

      - name: 📦 Setup NuGet
        uses: NuGet/setup-nuget@fd55a6f3b34392fa83fde1454582407d8c714123

      - name: 🗄️ Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
        with:
          dotnet-version: "10.0.x"

      - name: ☕ Set up JDK 17
        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a
        with:
          java-version: 17
          distribution: "zulu"

      - name: 🔧 Clear NuGet cache
        run: dotnet nuget locals all --clear

      - name: 📦 Install SonarQube Tools
        run: dotnet tool install --global --ignore-failed-sources dotnet-sonarscanner

      - name: 📦 Install Coverlet Tools
        run: dotnet tool install --global --ignore-failed-sources coverlet.console

      - name: 🔧 Fix Permission
        run: |
          if [ -d sonar ]; then
            chmod -R u+rwX,go+rX,go-w sonar
          fi

      - name: 🔍 Prepare analysis on SonarQube
        env:
          SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN || secrets.SONAR_TOKEN }}
        run: |
          echo "🔍 Checking SonarQube configuration..."
          if [ -z "$SONAR_TOKEN" ]; then
            echo "❌ SONAR_TOKEN is not set or empty"
            echo "⚠️ Skipping SonarQube analysis"
            exit 0
          fi

          echo "✅ SONAR_TOKEN is configured"
          dotnet sonarscanner begin \
            /o:"afonsoft" \
            /k:"afonsoft_QRCoder.Core" \
            /d:sonar.host.url="https://sonarcloud.io" \
            /d:sonar.token="$SONAR_TOKEN" \
            /d:sonar.scm.provider=git \
            /d:sonar.coverage.exclusions="**Test*.cs"

      - name: 🏗️ Build
        run: dotnet build QRCoder.Core.sln --configuration release

      - name: 🔍 Run Code Analysis
        env:
          SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN || secrets.SONAR_TOKEN }}
        run: |
          echo "🔍 Finalizing SonarQube analysis..."
          if [ -z "$SONAR_TOKEN" ]; then
            echo "⚠️ SONAR_TOKEN not configured, skipping analysis"
            exit 0
          fi

          dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN"

  # Snyk Security Analysis
  snyk:
    name: 🛡️ Snyk Security
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
      - name: 📥 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

      - name: 🗄️ Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
        with:
          dotnet-version: "10.0.x"

      - name: 🔧 Restore Dependencies
        run: dotnet restore QRCoder.Core.sln --ignore-failed-sources

      - name: 🛡️ Run Snyk
        uses: snyk/actions/dotnet@8e119fbb6c251787721d34ba683ed48eba792766
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: test
          args: --file=QRCoder.Core.sln --severity-threshold=high --sarif-file-output=snyk.sarif --json-output=snyk.json

      - name: 📊 Upload Snyk Results
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
        if: always() && hashFiles('snyk.sarif') != ''
        with:
          sarif_file: snyk.sarif
          category: snyk

      - name: 📋 Generate Snyk Summary
        if: always()
        run: |
          echo "## 🛡️ Snyk Security Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ -f "snyk.json" ]; then
            echo "### 📊 Vulnerability Summary" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            
            # Extract summary from JSON
            VULNS=$(cat snyk.json | jq -r '.results[0].vulnerabilities | length' 2>/dev/null || echo "0")
            DEPS=$(cat snyk.json | jq -r '.results[0].dependencies | length' 2>/dev/null || echo "0")
            
            echo "- **Dependencies Analyzed**: $DEPS" >> $GITHUB_STEP_SUMMARY
            echo "- **Vulnerabilities Found**: $VULNS" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            
            if [ "$VULNS" -gt 0 ]; then
              echo "### ⚠️ Vulnerabilities Detected" >> $GITHUB_STEP_SUMMARY
              echo "" >> $GITHUB_STEP_SUMMARY
              
              # Extract vulnerability details
              cat snyk.json | jq -r '.results[0].vulnerabilities[] | 
                "- **\(.severity | ascii_upcase)**: \(.title) in \(.package)@\(.version)"' 2>/dev/null | head -10 >> $GITHUB_STEP_SUMMARY
              
              echo "" >> $GITHUB_STEP_SUMMARY
              echo "### 🔧 Affected Projects" >> $GITHUB_STEP_SUMMARY
              echo "" >> $GITHUB_STEP_SUMMARY
              
              # Extract affected projects
              cat snyk.json | jq -r '.results[0].vulnerabilities[] | 
                "- \(.from[0] | split("/")[-1])"' 2>/dev/null | sort -u >> $GITHUB_STEP_SUMMARY
            else
              echo "✅ **No vulnerabilities found!** All dependencies are secure." >> $GITHUB_STEP_SUMMARY
            fi
          else
            echo "⚠️ **Snyk scan results not available**" >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📋 Scan Configuration" >> $GITHUB_STEP_SUMMARY
          echo "- **Severity Threshold**: High" >> $GITHUB_STEP_SUMMARY
          echo "- **Target**: QRCoder.Core.sln" >> $GITHUB_STEP_SUMMARY
          echo "- **Scanner**: Snyk .NET" >> $GITHUB_STEP_SUMMARY

  # Code Quality Metrics
  quality-metrics:
    name: 📈 Quality Metrics
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: 📥 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

      - name: 🗄️ Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
        with:
          dotnet-version: "10.0.x"

      - name: 🔧 Restore Dependencies
        run: dotnet restore QRCoder.Core.sln --ignore-failed-sources

      - name: 🏗️ Build Solution
        run: dotnet build QRCoder.Core.sln --configuration Release --no-restore --verbosity minimal

      - name: 📊 Calculate Metrics
        run: |
          echo "📊 Analyzing code quality metrics..."

          # Count lines of code
          echo "Lines of Code: $(find src -name '*.cs' -exec wc -l {} + | tail -1 | awk '{print $1}')"

          # Count test files
          echo "Test Files: $(find tests -name '*Tests.cs' | wc -l)"

          # Count projects
          echo "Projects: $(find src -name '*.csproj' | wc -l)"

          # Count pending markers in source files
          echo "Pending markers: $(grep -r 'TODO' src --include='*.cs' | wc -l)"

          echo "Quality metrics analysis completed!"

  # Quality Summary
  quality-summary:
    name: 📋 Quality Summary
    runs-on: ubuntu-latest
    needs: [qodana, sonarqube, snyk, quality-metrics]
    if: always()
    permissions:
      contents: read

    steps:
      - name: 📋 Generate Quality Report
        run: |
          echo "## 📊 Code Quality Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Tool | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| 🔍 Qodana | ${{ needs.qodana.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| 📊 SonarQube | ${{ needs.sonarqube.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| 🛡️ Snyk | ${{ needs.snyk.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| 📈 Metrics | ${{ needs.quality-metrics.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [[ "${{ needs.qodana.result }}" == "failure" || "${{ needs.sonarqube.result }}" == "failure" || "${{ needs.snyk.result }}" == "failure" ]]; then
            echo "❌ **Quality issues detected! Please review the analysis reports.**" >> $GITHUB_STEP_SUMMARY
          else
            echo "✅ **All quality checks passed!**" >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📊 Quality Metrics" >> $GITHUB_STEP_SUMMARY
          echo "- **Lines of Code**: Calculated during build" >> $GITHUB_STEP_SUMMARY
          echo "- **Test Coverage**: Available in CI pipeline" >> $GITHUB_STEP_SUMMARY
          echo "- **Technical Debt**: Analyzed by Qodana & SonarQube" >> $GITHUB_STEP_SUMMARY
          echo "- **Security**: Scanned by Snyk" >> $GITHUB_STEP_SUMMARY