ci(sonar): set up SonarQube Cloud monorepo analysis

[devin-ai-integration]

Summary

Sets up SonarQube Cloud monorepo support so each Nx project in the abapify/adt-cli workspace is analyzed as a separate Sonar project, all bound to the same repository.

What changed:

• Added .github/workflows/sonar.yml that reads sonar-matrix.json and runs a parallel matrix of SonarSource/sonarqube-scan-action@v8 jobs. Each job reuses the shared sonar-project.properties and passes a per-project sonar.projectKey, sonar.projectName, and sonar.sources.
• Added scripts/sonar-monorepo.ts to derive the project list from nx show projects, build a Sonar-safe key/name mapping, and regenerate the matrix and bulk-import files.
• Added sonar-monorepo.json (for bulk import into SonarQube Cloud) and sonar-matrix.json (for the CI matrix). The adt-cli package keeps the existing abapify_adt-cli key; all other projects use abapify_adt-cli_<suffix>.

After merging, create the Sonar projects by importing sonar-monorepo.json in SonarQube Cloud's monorepo setup wizard, and ensure the SONAR_TOKEN repository secret is set.

Link to Devin session: https://app.devin.ai/sessions/d423b79ba4f64c8bb0bf28c446a6d341
Requested by: @ThePlenkov

---

Summary by cubic

Sets up SonarQube Cloud monorepo analysis so each Nx project in abapify/adt-cli runs as its own Sonar project via GitHub Actions. Keeps the abapify_adt-cli key for @abapify/adt-cli, validates SONAR_TOKEN, and tightens CI/Codacy rules.

• New Features

  • Add .github/workflows/sonar.yml with a token check and a matrix from sonar-matrix.json, pinned to full commit SHAs; runs SonarSource/sonarqube-scan-action@v8 with an inline nosemgrep suppression.
  • Add scripts/sonar-monorepo.ts to derive keys/names/sources and generate sonar-monorepo.json (import) and sonar-matrix.json (CI).
  • Set default sonar.sources in sonar-project.properties to packages/adt-cli/src; matrix jobs pass per-project sources.
  • Update .codacy.yml to exclude .github/workflows/sonar.yml and scripts/sonar-monorepo.ts from eslint-8 and opengrep.

• Migration

  • Import sonar-monorepo.json in SonarQube Cloud to create projects.
  • Set the SONAR_TOKEN repository secret; the workflow validates it before running.

^{Written for commit 8eee5b9. Summary will update on new commits.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[netlify]

✅ Deploy Preview for adt-cli canceled.

Name	Link
🔨 Latest commit	8eee5b9
🔍 Latest deploy log	https://app.netlify.com/projects/adt-cli/deploys/6a7358b1da05e30008cd92c0

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 8eee5b9

Command	Status	Duration	Result
nx affected -t lint test build e2e-ci --verbose...	✅ Succeeded	5s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-05 15:38:07 UTC

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 17 complexity · 0 duplication

Metric	Results
Complexity	17
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing