📊 Chore: Setup SonarQube Quality Gate

Goal

Integrate SonarQube/SonarCloud analysis into the CI/CD pipeline with quality gates that block PRs failing code quality thresholds.

Why Now?

1. Local Setup Exists: sonar-code.properties and podman-compose-sonarqube.yaml are already configured
2. Quality Enforcement: PRs should be blocked if they introduce bugs, vulnerabilities, or code smells
3. Technical Debt Tracking: SonarQube provides visibility into accumulated technical debt
4. Coverage Tracking: Centralized coverage reporting with historical trends
5. Security Analysis: SAST (Static Application Security Testing) for vulnerability detection

Current State

📖 User Stories

Given a PR is opened with code changes
When the SonarQube analysis workflow runs
Then the analysis should check:
  - No new bugs introduced
  - No new vulnerabilities
  - No new security hotspots
  - Code coverage >= 80% on new code
  - Duplication <= 3% on new code
And the PR status check should fail if any threshold is exceeded
And the PR should be blocked from merge

Given a PR with code quality issues
When the SonarQube analysis completes
Then the PR should show:
  - Summary comment with issue counts
  - Link to full SonarQube dashboard
  - Inline annotations on problem lines (if using SonarCloud)
And new issues should be clearly distinguished from existing ones

Given the main branch is analyzed on each merge
When I view the SonarQube dashboard
Then I should see:
  - Overall quality rating (A-E)
  - Bug, vulnerability, and code smell counts
  - Test coverage percentage with trends
  - Duplication percentage with trends
  - Technical debt estimation
And historical data should be preserved for comparison

Given code with potential security issues (SQL injection, XSS, etc.)
When the SonarQube analysis runs
Then security vulnerabilities should be flagged
And security hotspots should be identified for review
And the quality gate should fail on new vulnerabilities

📋 Implementation Tasks

Phase 1: SonarCloud Setup (Recommended)

• Create SonarCloud organization for IBM/mcp-context-forge
• Import project and configure analysis
• Generate SONAR_TOKEN and add to GitHub secrets
• Enable automatic analysis on PRs
• Configure PR decoration

Phase 2: GitHub Actions Workflow

• Create .github/workflows/sonarqube.yml
• Configure triggers: push to main, pull_request
• Generate coverage report in Cobertura/XML format
• Run sonar-scanner with coverage data
• Add quality gate check step

Phase 3: Quality Gate Configuration

• Define quality gate thresholds:
  • Coverage on new code >= 80%
  • Duplicated lines on new code <= 3%
  • Maintainability rating >= A
  • Reliability rating >= A
  • Security rating >= A
  • No new bugs
  • No new vulnerabilities
• Apply quality gate to project

Phase 4: Documentation & Monitoring

• Add SonarCloud badge to README
• Document quality gate requirements in CONTRIBUTING.md
• Set up notifications for quality gate failures
• Create dashboard for team visibility

⚙️ Proposed Workflow

.github/workflows/sonarqube.yml

name: SonarQube Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  pull-requests: read

jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for blame data

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: |
          pip install -e ".[dev]"

      - name: Run tests with coverage
        run: |
          pytest --cov=mcpgateway --cov-report=xml:coverage.xml \
                 --junitxml=junit.xml -n auto

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.projectKey=IBM_mcp-context-forge
            -Dsonar.organization=ibm
            -Dsonar.python.coverage.reportPaths=coverage.xml
            -Dsonar.python.xunit.reportPath=junit.xml

      - name: Check Quality Gate
        uses: SonarSource/sonarcloud-github-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: -Dsonar.qualitygate.wait=true

Quality Gate Thresholds

✅ Success Criteria

• SonarCloud/SonarQube project created
• GitHub Actions workflow running on PRs
• Quality gate blocking failing PRs
• Coverage data visible in dashboard
• PR decoration showing issues
• README badge showing quality status

🔗 Related

• sonar-code.properties - Existing scanner configuration
• podman-compose-sonarqube.yaml - Local SonarQube setup
• Makefile - sonar-* targets for local scanning

📚 References

• SonarCloud GitHub Action
• SonarQube Quality Gates
• Python Coverage with SonarQube