configure-sonarcloud-collection

Create a sonar-project.properties at the repo root matching the SonarCloud project key, then add a GitHub Actions workflow that runs the SonarScanner with the org SONAR_TOKEN secret. Copy canonical templates so the workflow stays identical across ansible-collections repos.

SonarCloud reads coverage from a coverage.xml file at the repository root via sonar.python.coverage.reportPaths. Run pytest or tox with --cov-report xml:coverage.xml before the Sonar step so the file exists when the scanner executes.

GitHub does not expose secrets to workflows triggered by fork pull requests, so jobs needing SONAR_TOKEN cannot authenticate. Use a workflow_run follow-up pattern where an untrusted job uploads coverage artifacts and a trusted workflow downloads them and runs the scanner.

The workflow_run template follows the amazon.aws pattern where a trusted workflow downloads coverage artifacts after tests complete. The workflow_call template is a reusable workflow called from an aggregator like all_green_check.yaml with explicit secrets passed, as in kubernetes.core.

Do not use it to view or fix existing Sonar findings on an already-configured project; that belongs to remediation work. It also does not cover the second-phase coverage rollout with badges and artifact wiring, which is a separate follow-up step.