feat: add support for SonarQube

.woodpecker/publish.yml

@@ -45,7 +45,32 @@ steps:
       - npx nx run-many --target=build --projects="$PROJECTS"
 
   # -------------------------------------------------------------------------
-  # 3. Determine the version and npm dist-tag, then publish every project.
+  # 3. Run tests and collect coverage for SonarQube
+  # -------------------------------------------------------------------------
+  - name: test
+    image: *node_image
+    environment:
+      PUBLISH_PROJECTS: *default_projects
+    commands:
+      - PROJECTS="${PUBLISH_PROJECTS:-reviews-stars}"
+      - npx nx run-many -t test --code-coverage --passWithNoTests --projects="$PROJECTS"
+
+  # -------------------------------------------------------------------------
+  # 4. SonarQube analysis (runs against the tag/branch being released)
+  # -------------------------------------------------------------------------
+  - name: sonar
+    image: sonarsource/sonar-scanner-cli:latest
+    environment:
+      SONAR_HOST_URL:
+        from_secret: SONAR_HOST_URL
+      SONAR_TOKEN:
+        from_secret: SONAR_TOKEN
+    commands:
+      - sonar-scanner
+        -Dsonar.projectVersion=${CI_COMMIT_TAG#v}
+
+  # -------------------------------------------------------------------------
+  # 5. Determine the version and npm dist-tag, then publish every project.
   #
   #    For tag events  : version is derived from the tag (strips leading "v").
   #    For manual runs : VERSION env-var must be supplied via the Woodpecker