Set up SonarQube code analysis

.github/workflows/sonar.yaml

@@ -0,0 +1,31 @@
+on:
+  # Trigger analysis for pushes and pull requests
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+name: SonarQube Main Workflow
+jobs:
+  sonarqube:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Fetch full history for better SCM information
+          fetch-depth: 0
+
+      - name: Run SonarQube Scan
+        uses: sonarsource/sonarqube-scan-action@master # @master tag vs. commit hash is the prescribed pattern by our security team for sonarsource/
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+
+      - name: Quality Gate Check
+        uses: sonarsource/sonarqube-quality-gate-action@master # @master tag vs. commit hash is the prescribed pattern by our security team for sonarsource/
+        timeout-minutes: 5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

sonar-project.properties

@@ -0,0 +1,21 @@
+# Server and project configuration
+# Note: SONAR_HOST_URL is also passed at scan time. This entry documents the
+# expected host and is a no-op when the runtime value takes precedence.
+sonar.host.url=https://sonar.wpengine.io/
+sonar.projectVersion=1.0
+sonar.sourceEncoding=UTF-8
+sonar.scm.provider=git
+
+# Project identifiers
+sonar.projectName=create-local-addon
+sonar.projectKey=getflywheel_create-local-addon_52669db6-8a86-4010-8c17-d085eeae8d59
+
+# Paths to source code directories (relative paths)
+sonar.sources=.
+
+# Exclusions — test files + vendor dirs
+sonar.exclusions=**/*.test.*,**/*.spec.*,node_modules/**
+
+# Paths to test code directories (relative paths)
+sonar.tests=.
+sonar.test.inclusions=**/*.test.*,**/*.spec.*