analyze.yml

name: Analyze PR

on:
  workflow_run:
    workflows:
      - Verify
    types:
      - completed

jobs:
  analyze:
    name: Analyze PR
    runs-on: ubuntu-latest
    env:
      artifact-reports: reports
    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
    steps:
      - name: Get PR info
        uses: actions/github-script@v7
        with:
          script: |
            var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "${{env.artifact-reports}}"
            })[0];
            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('${{github.workspace}}/reports.zip', Buffer.from(download.data));

      - name: Extract PR info
        id: pr
        run: |
          unzip reports.zip
          cat pr_data.txt >> $GITHUB_OUTPUT

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: refs/pull/${{ steps.pr.outputs.number }}/merge

      - name: Get reports
        uses: actions/github-script@v7
        with:
          script: |
            var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "${{env.artifact-reports}}"
            })[0];
            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('${{github.workspace}}/reports.zip', Buffer.from(download.data));

      - name: Extract reports
        run: unzip reports.zip

      - name: SonarCloud
        uses: SonarSource/sonarcloud-github-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.pullrequest.provider=github
            -Dsonar.pullrequest.github.repository=${{ github.repository }}
            -Dsonar.pullrequest.github.token.secured=${{ secrets.GITHUB_TOKEN }}
            -Dsonar.pullrequest.key=${{ steps.pr.outputs.number }}
            -Dsonar.pullrequest.branch=${{ steps.pr.outputs.head_ref }}
            -Dsonar.pullrequest.base=${{ steps.pr.outputs.base_ref }}

      - name: Publish Coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          override_pr: ${{ steps.pr.outputs.number }}
          override_commit: ${{ steps.pr.outputs.head_sha }}
          files: ./coverage/clover.xml
          flags: tests
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Publish Test Results to Codecov
        uses: codecov/test-results-action@v1
        with:
          override_pr: ${{ steps.pr.outputs.number }}
          override_commit: ${{ steps.pr.outputs.head_sha }}
          files: ./reports/junit.xml
          flags: tests
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Add comment to PR if job fails
        if: ${{ failure() }}
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          header: analyze
          number: ${{ steps.pr.outputs.number }}
          recreate: true
          message: |
            :x: Failed to run [SonarCloud and/or code coverage](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) step.

      - name: Add comment to PR if job succeeds
        if: ${{ success() }}
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          header: analyze
          number: ${{ steps.pr.outputs.number }}
          recreate: true
          message: |
            :ok: Published [SonarCloud and code coverage](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) data.