From c2dc2c2f85aa20cc98470eec06f3a199b1c6fb2e Mon Sep 17 00:00:00 2001
From: jessicamack <jmack@redhat.com>
Date: Wed, 15 Jul 2026 10:36:06 -0400
Subject: [PATCH 1/7] feat:  add workflow for SonarCloud reporting

---
 .github/workflows/sonarcloud_pr.yml | 245 ++++++++++++++++++++++++++++
 1 file changed, 245 insertions(+)
 create mode 100644 .github/workflows/sonarcloud_pr.yml

diff --git a/.github/workflows/sonarcloud_pr.yml b/.github/workflows/sonarcloud_pr.yml
new file mode 100644
index 00000000..91cfe87a
--- /dev/null
+++ b/.github/workflows/sonarcloud_pr.yml
@@ -0,0 +1,245 @@
+# SonarCloud Analysis Workflow for awx_plugins.interfaces
+#
+# This workflow runs SonarCloud analysis triggered by CI workflow completion.
+# It is split into two separate jobs for clarity and maintainability:
+#
+# FLOW: CI completes → workflow_run triggers this workflow → appropriate job runs
+#
+# JOB 1: sonar-pr-analysis (for PRs)
+# - Triggered by: workflow_run (CI on pull_request)
+# - Steps: Download coverage → Get PR info → Get changed files → Run SonarCloud PR analysis
+# - Scans: All changed files in the PR (Python, YAML, JSON, etc.)
+# - Quality gate: Focuses on new/changed code in PR only
+#
+# JOB 2: sonar-branch-analysis (for long-lived branches)
+# - Triggered by: workflow_run (CI on push to devel)
+# - Steps: Download coverage → Run SonarCloud branch analysis
+# - Scans: Full codebase
+# - Quality gate: Focuses on overall project health
+#
+# This ensures coverage data is always available from CI before analysis runs.
+#
+# What files are scanned:
+# - All files in the repository that SonarCloud can analyze
+# - Excludes: tests, scripts, dev environments, external collections (see sonar-project.properties)
+
+
+# With much help from:
+# https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/30
+# https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/32
+name: SonarCloud
+on:
+  workflow_run:   # This is triggered by CI being completed.
+    workflows:
+      - CI
+    types:
+      - completed
+permissions:
+  contents: read
+  actions: read
+  pull_requests: read
+jobs:
+  sonar-pr-analysis:
+    name: SonarCloud PR Analysis
+    runs-on: ubuntu-latest
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.repository == 'ansible/awx_plugins.interfaces'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      # Download all individual coverage artifacts from CI workflow
+      - name: Download coverage artifacts
+        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workflow: CI
+          run_id: ${{ github.event.workflow_run.id }}
+          pattern: api-test-artifacts
+
+      # Extract PR metadata from workflow_run event
+      - name: Set PR metadata and prepare files for analysis
+        env:
+          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
+          REPO_NAME: ${{ github.event.repository.full_name }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Find all downloaded coverage XML files
+          coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
+          echo "Found coverage files: $coverage_files"
+          echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
+
+          # Extract PR number from first coverage.xml file found
+          first_coverage=$(find . -name "coverage.xml" -type f | head -1)
+          if [ -f "$first_coverage" ]; then
+            PR_NUMBER=$(grep -m 1 '<!-- PR' "$first_coverage" | awk '{print $3}' || echo "")
+          else
+            PR_NUMBER=""
+          fi
+
+          echo "🔍 SonarCloud Analysis Decision Summary"
+          echo "========================================"
+          echo "├── CI Event: ✅ Pull Request"
+          echo "├── PR Number from coverage.xml: #${PR_NUMBER:-<not found>}"
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "##[error]❌ FATAL: PR number not found in coverage.xml"
+            echo "##[error]This job requires a PR number to run PR analysis."
+            echo "##[error]The ci workflow should have injected the PR number into coverage.xml."
+            exit 1
+          fi
+
+          # Get PR metadata from GitHub API
+          PR_DATA=$(gh api "repos/$REPO_NAME/pulls/$PR_NUMBER")
+          PR_BASE=$(echo "$PR_DATA" | jq -r '.base.ref')
+          PR_HEAD=$(echo "$PR_DATA" | jq -r '.head.ref')
+
+          # Print summary
+          echo "🔍 SonarCloud Analysis Decision Summary"
+          echo "========================================"
+          echo "├── CI Event: ✅ Pull Request"
+          echo "├── PR Number: #$PR_NUMBER"
+          echo "├── Base Branch: $PR_BASE"
+          echo "├── Head Branch: $PR_HEAD"
+          echo "├── Repo: $REPO_NAME"
+
+          # Export to GitHub env for later steps
+          echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
+          echo "PR_BASE=$PR_BASE" >> $GITHUB_ENV
+          echo "PR_HEAD=$PR_HEAD" >> $GITHUB_ENV
+          echo "COMMIT_SHA=$COMMIT_SHA" >> $GITHUB_ENV
+          echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
+
+          # Get all changed files from PR (with error handling)
+          # PR_NUMBER is guaranteed non-empty here (fatal exit above if missing)
+          files=""
+          if gh api repos/$REPO_NAME/pulls/$PR_NUMBER/files --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
+            files=$(cat /tmp/pr_files.txt)
+          else
+            echo "├── Changed Files: ⚠️  Could not fetch (likely test repo or PR not found)"
+            if [ -f coverage.xml ] && [ -s coverage.xml ]; then
+              echo "├── Coverage Data: ✅ Available"
+            else
+              echo "├── Coverage Data: ⚠️  Not available"
+            fi
+            echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
+            # No files = no inclusions filter = full scan
+            exit 0
+          fi
+
+          # Get file extensions and count for summary
+          extensions=$(echo "$files" | sed 's/.*\.//' | sort | uniq | tr '\n' ',' | sed 's/,$//')
+          file_count=$(echo "$files" | wc -l)
+          echo "├── Changed Files: $file_count file(s) (.${extensions})"
+
+          # Check if coverage.xml exists and has content
+          if [ -f coverage.xml ] && [ -s coverage.xml ]; then
+            echo "├── Coverage Data: ✅ Available"
+          else
+            echo "├── Coverage Data: ⚠️  Not available (analysis will proceed without coverage)"
+          fi
+
+          # Prepare file list for Sonar
+          echo "All changed files in PR:"
+          echo "$files"
+
+          # Filter out files that are excluded by .coveragerc to avoid coverage conflicts
+          # This prevents SonarCloud from analyzing files that have no coverage data
+          if [ -n "$files" ]; then
+            # Filter out files matching .coveragerc omit patterns
+            filtered_files=$(echo "$files" | grep -v "settings/.*_defaults\.py$" | grep -v "settings/defaults\.py$" | grep -v "main/migrations/")
+
+            # Show which files were filtered out for transparency
+            excluded_files=$(echo "$files" | grep -E "(settings/.*_defaults\.py$|settings/defaults\.py$|main/migrations/)" || true)
+            if [ -n "$excluded_files" ]; then
+              echo "├── Filtered out (coverage-excluded): $(echo "$excluded_files" | wc -l) file(s)"
+              echo "$excluded_files" | sed 's/^/│   - /'
+            fi
+
+            if [ -n "$filtered_files" ]; then
+              inclusions=$(echo "$filtered_files" | tr '\n' ',' | sed 's/,$//')
+              echo "SONAR_INCLUSIONS=$inclusions" >> $GITHUB_ENV
+              echo "└── Result: ✅ Will scan these files (excluding coverage-omitted files): $inclusions"
+            else
+              echo "└── Result: ✅ All changed files are excluded by coverage config, running full SonarCloud analysis"
+              # Don't set SONAR_INCLUSIONS, let it scan everything per sonar-project.properties
+            fi
+          else
+            echo "└── Result: ✅ Running SonarCloud analysis"
+          fi
+
+      - name: Add base branch
+        if: env.PR_NUMBER != ''
+        run: |
+          gh pr checkout ${{ env.PR_NUMBER }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
+        with:
+          args: >
+            -Dsonar.scm.revision=${{ env.COMMIT_SHA }}
+            -Dsonar.pullrequest.key=${{ env.PR_NUMBER }}
+            -Dsonar.pullrequest.branch=${{ env.PR_HEAD }}
+            -Dsonar.pullrequest.base=${{ env.PR_BASE }}
+            ${{ env.COVERAGE_PATHS && format('-Dsonar.python.coverage.reportPaths={0}', env.COVERAGE_PATHS) || '' }}
+            ${{ env.SONAR_INCLUSIONS && format('-Dsonar.inclusions={0}', env.SONAR_INCLUSIONS) || '' }}
+
+  sonar-branch-analysis:
+    name: SonarCloud Branch Analysis
+    runs-on: ubuntu-latest
+    if: |
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.repository == 'ansible/awx_plugins.interfaces'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      # Download all individual coverage artifacts from CI workflow (optional for branch pushes)
+      - name: Download coverage artifacts
+        continue-on-error: true
+        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workflow: CI
+          run_id: ${{ github.event.workflow_run.id }}
+          pattern: api-test-artifacts
+
+      - name: Print SonarCloud Analysis Summary
+        env:
+          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          # Find all downloaded coverage XML files
+          coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
+          echo "Found coverage files: $coverage_files"
+          echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
+
+          echo "🔍 SonarCloud Analysis Summary"
+          echo "=============================="
+          echo "├── CI Event: ✅ Push (via workflow_run)"
+          echo "├── Branch: $BRANCH_NAME"
+          echo "├── Coverage Files: ${coverage_files:-none}"
+          echo "├── Python Changes: ➖ N/A (Full codebase scan)"
+          echo "└── Result: ✅ Proceed - \"Running SonarCloud analysis\""
+
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
+        with:
+          args: >
+            -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
+            -Dsonar.branch.name=${{ github.event.workflow_run.head_branch }}
+            ${{ env.COVERAGE_PATHS && format('-Dsonar.python.coverage.reportPaths={0}', env.COVERAGE_PATHS) || '' }}

From 9686eb5c57775ccbeb88c5bc2a090fa2c8c04a81 Mon Sep 17 00:00:00 2001
From: jessicamack <jmack@redhat.com>
Date: Wed, 22 Jul 2026 10:28:17 -0400
Subject: [PATCH 2/7] add missing file. update workflow

---
 .github/workflows/sonarcloud_pr.yml |  27 ++++--
 sonar-project.properties            | 132 ++++++++++++++++++++++++++++
 2 files changed, 150 insertions(+), 9 deletions(-)
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonarcloud_pr.yml b/.github/workflows/sonarcloud_pr.yml
index 91cfe87a..7330c03c 100644
--- a/.github/workflows/sonarcloud_pr.yml
+++ b/.github/workflows/sonarcloud_pr.yml
@@ -37,7 +37,7 @@ on:
 permissions:
   contents: read
   actions: read
-  pull_requests: read
+  pull-requests: read
 jobs:
   sonar-pr-analysis:
     name: SonarCloud PR Analysis
@@ -49,6 +49,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       # Download all individual coverage artifacts from CI workflow
@@ -59,6 +60,8 @@ jobs:
           workflow: CI
           run_id: ${{ github.event.workflow_run.id }}
           pattern: api-test-artifacts
+          if_no_artifact_found: ignore
+          continue-on-error: true
 
       # Extract PR metadata from workflow_run event
       - name: Set PR metadata and prepare files for analysis
@@ -81,11 +84,6 @@ jobs:
             PR_NUMBER=""
           fi
 
-          echo "🔍 SonarCloud Analysis Decision Summary"
-          echo "========================================"
-          echo "├── CI Event: ✅ Pull Request"
-          echo "├── PR Number from coverage.xml: #${PR_NUMBER:-<not found>}"
-
           if [ -z "$PR_NUMBER" ]; then
             echo "##[error]❌ FATAL: PR number not found in coverage.xml"
             echo "##[error]This job requires a PR number to run PR analysis."
@@ -117,7 +115,7 @@ jobs:
           # Get all changed files from PR (with error handling)
           # PR_NUMBER is guaranteed non-empty here (fatal exit above if missing)
           files=""
-          if gh api repos/$REPO_NAME/pulls/$PR_NUMBER/files --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
+          if gh api repos/$REPO_NAME/pulls/$PR_NUMBER/files --paginate --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
             files=$(cat /tmp/pr_files.txt)
           else
             echo "├── Changed Files: ⚠️  Could not fetch (likely test repo or PR not found)"
@@ -172,10 +170,21 @@ jobs:
             echo "└── Result: ✅ Running SonarCloud analysis"
           fi
 
-      - name: Add base branch
+      - name: Prepare repository for PR analysis
         if: env.PR_NUMBER != ''
         run: |
-          gh pr checkout ${{ env.PR_NUMBER }}
+          # Validate PR_NUMBER is numeric to prevent command injection
+          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+            echo "##[error]Invalid PR number: $PR_NUMBER"
+            exit 1
+          fi
+
+          # Fetch the PR branch for SonarCloud PR analysis comparison
+          git fetch origin "$PR_BASE"
+
+          # Checkout the exact commit that CI tested, not the current PR head
+          # This ensures SonarCloud analyzes the same code that CI validated
+          git checkout "$COMMIT_SHA"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 00000000..fd62ebd2
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,132 @@
+# SonarCloud project configuration for awx_plugins.interfaces
+# Complete documentation: https://docs.sonarqube.org/latest/analysis/analysis-parameters/
+
+# =============================================================================
+# PROJECT IDENTIFICATION (REQUIRED)
+# =============================================================================
+
+# The unique project identifier. This is mandatory.
+# Do not duplicate or reuse!
+# Available characters: [a-zA-Z0-9_:\.\-]
+# Must have least one non-digit.
+sonar.projectKey=ansible_awx_plugins.interfaces
+sonar.organization=ansible
+
+# Project metadata
+sonar.projectName=awx_plugins.interfaces
+
+# =============================================================================
+# SOURCE AND TEST CONFIGURATION
+# =============================================================================
+
+# Source directories to analyze
+sonar.sources=.
+
+# Test directories
+sonar.tests=tests
+
+# Test file patterns
+sonar.test.inclusions=\
+    **/*_test.py,\
+    **/tests/**/*.py
+
+# Set branch-specific new code definition
+#
+# This is important to always check against the main branch for new PRs,
+# otherwise the PR may fail during backporting, since the old version of the code
+# may not respect the minimum requirements for the existing Quality Gate.
+sonar.newCode.referenceBranch=devel
+
+# =============================================================================
+# LANGUAGE CONFIGURATION
+# =============================================================================
+
+# Python versions supported by the project
+#sonar.python.version=3.9,3.10,3.11
+
+# File encoding
+sonar.sourceEncoding=UTF-8
+
+# =============================================================================
+# REPORTS AND COVERAGE
+# =============================================================================
+
+# Test and coverage reports (paths relative to project root)
+sonar.python.coverage.reportPaths=reports/coverage.xml,awxkit/coverage.xml
+sonar.python.xunit.reportPath=/reports/junit.xml
+
+# External tool reports (add these paths when tools are configured)
+# sonar.python.pylint.reportPaths=reports/pylint-report.txt
+# sonar.python.bandit.reportPaths=reports/bandit-report.json
+# sonar.python.mypy.reportPath=reports/mypy-report.txt
+# sonar.python.flake8.reportPaths=reports/flake8-report.txt
+# sonar.python.xunit.reportPath=reports/junit.xml
+
+# =============================================================================
+# EXCLUSIONS - FILES AND DIRECTORIES TO IGNORE
+# =============================================================================
+
+# General exclusions - files and directories to ignore from analysis
+sonar.exclusions=\
+    **/tests/**,\
+    **/__pycache__/**,\
+    **/*.pyc,\
+    **/*.pyo,\
+    **/*.pyd,\
+    **/build/**,\
+    **/dist/**,\
+    **/*.egg-info/**,\
+    **/download-json.py,\
+    docs/docsite/conf.py
+
+# =============================================================================
+# COVERAGE EXCLUSIONS
+# =============================================================================
+
+# Files to exclude from coverage calculations
+sonar.coverage.exclusions=\
+    **/tests/**,\
+    **/.tox/**,\
+    **/test_*.py,\
+    **/*_test.py
+
+# =============================================================================
+# DUPLICATION EXCLUSIONS
+# =============================================================================
+
+# Ignore code duplication in migrations and tests
+sonar.cpd.exclusions=\
+    **/tests/**
+
+# =============================================================================
+# ISSUE IGNORE RULES
+# =============================================================================
+
+# Ignore specific rules for certain file patterns
+sonar.issue.ignore.multicriteria=e1
+# Ignore "should be a variable" in migrations
+sonar.issue.ignore.multicriteria.e1.ruleKey=python:S1192
+
+# =============================================================================
+# GITHUB INTEGRATION
+# =============================================================================
+
+# The following properties are automatically handled by GitHub Actions:
+# sonar.pullrequest.key - handled automatically
+# sonar.pullrequest.branch - handled automatically  
+# sonar.pullrequest.base - handled automatically
+
+# =============================================================================
+# DEBUGGING
+# =============================================================================
+
+# These are aggressive settings to ensure maximum detection
+# do not use in production
+
+# sonar.verbose=true
+# sonar.log.level=DEBUG
+# sonar.scm.exclusions.disabled=true
+# sonar.java.skipUnchanged=false
+# sonar.scm.forceReloadAll=true
+# sonar.filesize.limit=100
+# sonar.qualitygate.wait=true
\ No newline at end of file

From f15ac644c2b1a22afaf997263a74f0b7af38fa17 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:29:20 +0000
Subject: [PATCH 3/7] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 sonar-project.properties | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sonar-project.properties b/sonar-project.properties
index fd62ebd2..28356e05 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -113,7 +113,7 @@ sonar.issue.ignore.multicriteria.e1.ruleKey=python:S1192
 
 # The following properties are automatically handled by GitHub Actions:
 # sonar.pullrequest.key - handled automatically
-# sonar.pullrequest.branch - handled automatically  
+# sonar.pullrequest.branch - handled automatically
 # sonar.pullrequest.base - handled automatically
 
 # =============================================================================
@@ -129,4 +129,4 @@ sonar.issue.ignore.multicriteria.e1.ruleKey=python:S1192
 # sonar.java.skipUnchanged=false
 # sonar.scm.forceReloadAll=true
 # sonar.filesize.limit=100
-# sonar.qualitygate.wait=true
\ No newline at end of file
+# sonar.qualitygate.wait=true

From 51dc55432e1bc95e4191341951f3d9fdce35e64a Mon Sep 17 00:00:00 2001
From: jessicamack <jmack@redhat.com>
Date: Thu, 23 Jul 2026 08:48:45 -0400
Subject: [PATCH 4/7] lint fixes

---
 .github/workflows/sonarcloud_pr.yml | 46 ++++++++++-------------------
 sonar-project.properties            |  2 +-
 2 files changed, 16 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/sonarcloud_pr.yml b/.github/workflows/sonarcloud_pr.yml
index 7330c03c..d2bd5153 100644
--- a/.github/workflows/sonarcloud_pr.yml
+++ b/.github/workflows/sonarcloud_pr.yml
@@ -42,6 +42,7 @@ jobs:
   sonar-pr-analysis:
     name: SonarCloud PR Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: |
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'pull_request' &&
@@ -76,18 +77,12 @@ jobs:
           echo "Found coverage files: $coverage_files"
           echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
 
-          # Extract PR number from first coverage.xml file found
-          first_coverage=$(find . -name "coverage.xml" -type f | head -1)
-          if [ -f "$first_coverage" ]; then
-            PR_NUMBER=$(grep -m 1 '<!-- PR' "$first_coverage" | awk '{print $3}' || echo "")
-          else
-            PR_NUMBER=""
-          fi
+          # Extract PR number from workflow_run event
+          PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}"
 
           if [ -z "$PR_NUMBER" ]; then
-            echo "##[error]❌ FATAL: PR number not found in coverage.xml"
+            echo "##[error]❌ FATAL: PR number not found in workflow_run event"
             echo "##[error]This job requires a PR number to run PR analysis."
-            echo "##[error]The ci workflow should have injected the PR number into coverage.xml."
             exit 1
           fi
 
@@ -119,7 +114,7 @@ jobs:
             files=$(cat /tmp/pr_files.txt)
           else
             echo "├── Changed Files: ⚠️  Could not fetch (likely test repo or PR not found)"
-            if [ -f coverage.xml ] && [ -s coverage.xml ]; then
+            if [ -n "$coverage_files" ]; then
               echo "├── Coverage Data: ✅ Available"
             else
               echo "├── Coverage Data: ⚠️  Not available"
@@ -145,29 +140,15 @@ jobs:
           echo "All changed files in PR:"
           echo "$files"
 
-          # Filter out files that are excluded by .coveragerc to avoid coverage conflicts
-          # This prevents SonarCloud from analyzing files that have no coverage data
+          # Set changed files as inclusions for SonarCloud PR analysis
+          # This focuses the scan on modified files only, improving performance
+          # Note: sonar-project.properties contains the project-wide exclusions
           if [ -n "$files" ]; then
-            # Filter out files matching .coveragerc omit patterns
-            filtered_files=$(echo "$files" | grep -v "settings/.*_defaults\.py$" | grep -v "settings/defaults\.py$" | grep -v "main/migrations/")
-
-            # Show which files were filtered out for transparency
-            excluded_files=$(echo "$files" | grep -E "(settings/.*_defaults\.py$|settings/defaults\.py$|main/migrations/)" || true)
-            if [ -n "$excluded_files" ]; then
-              echo "├── Filtered out (coverage-excluded): $(echo "$excluded_files" | wc -l) file(s)"
-              echo "$excluded_files" | sed 's/^/│   - /'
-            fi
-
-            if [ -n "$filtered_files" ]; then
-              inclusions=$(echo "$filtered_files" | tr '\n' ',' | sed 's/,$//')
-              echo "SONAR_INCLUSIONS=$inclusions" >> $GITHUB_ENV
-              echo "└── Result: ✅ Will scan these files (excluding coverage-omitted files): $inclusions"
-            else
-              echo "└── Result: ✅ All changed files are excluded by coverage config, running full SonarCloud analysis"
-              # Don't set SONAR_INCLUSIONS, let it scan everything per sonar-project.properties
-            fi
+            inclusions=$(echo "$files" | tr '\n' ',' | sed 's/,$//')
+            echo "SONAR_INCLUSIONS=$inclusions" >> $GITHUB_ENV
+            echo "└── Result: ✅ Will scan $file_count changed file(s)"
           else
-            echo "└── Result: ✅ Running SonarCloud analysis"
+            echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
           fi
 
       - name: Prepare repository for PR analysis
@@ -205,6 +186,7 @@ jobs:
   sonar-branch-analysis:
     name: SonarCloud Branch Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: |
       github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
@@ -213,6 +195,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
           persist-credentials: false
 
       # Download all individual coverage artifacts from CI workflow (optional for branch pushes)
diff --git a/sonar-project.properties b/sonar-project.properties
index 28356e05..e30edd4c 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -53,7 +53,7 @@ sonar.sourceEncoding=UTF-8
 
 # Test and coverage reports (paths relative to project root)
 sonar.python.coverage.reportPaths=reports/coverage.xml,awxkit/coverage.xml
-sonar.python.xunit.reportPath=/reports/junit.xml
+sonar.python.xunit.reportPath=reports/junit.xml
 
 # External tool reports (add these paths when tools are configured)
 # sonar.python.pylint.reportPaths=reports/pylint-report.txt

From afce158cf62b069d3eae9bb2213864a14214458b Mon Sep 17 00:00:00 2001
From: jessicamack <jmack@redhat.com>
Date: Tue, 28 Jul 2026 09:33:30 -0400
Subject: [PATCH 5/7] address shellcheck issues

---
 .github/workflows/sonarcloud_pr.yml | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/sonarcloud_pr.yml b/.github/workflows/sonarcloud_pr.yml
index d2bd5153..ba11877a 100644
--- a/.github/workflows/sonarcloud_pr.yml
+++ b/.github/workflows/sonarcloud_pr.yml
@@ -75,7 +75,7 @@ jobs:
           # Find all downloaded coverage XML files
           coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
           echo "Found coverage files: $coverage_files"
-          echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
+          echo "COVERAGE_PATHS=$coverage_files" >> "$GITHUB_ENV"
 
           # Extract PR number from workflow_run event
           PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}"
@@ -101,16 +101,18 @@ jobs:
           echo "├── Repo: $REPO_NAME"
 
           # Export to GitHub env for later steps
-          echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
-          echo "PR_BASE=$PR_BASE" >> $GITHUB_ENV
-          echo "PR_HEAD=$PR_HEAD" >> $GITHUB_ENV
-          echo "COMMIT_SHA=$COMMIT_SHA" >> $GITHUB_ENV
-          echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
+          {
+            echo "PR_NUMBER=$PR_NUMBER"
+            echo "PR_BASE=$PR_BASE"
+            echo "PR_HEAD=$PR_HEAD"
+            echo "COMMIT_SHA=$COMMIT_SHA"
+            echo "REPO_NAME=$REPO_NAME"
+          } >> "$GITHUB_ENV"
 
           # Get all changed files from PR (with error handling)
           # PR_NUMBER is guaranteed non-empty here (fatal exit above if missing)
           files=""
-          if gh api repos/$REPO_NAME/pulls/$PR_NUMBER/files --paginate --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
+          if gh api "repos/$REPO_NAME/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
             files=$(cat /tmp/pr_files.txt)
           else
             echo "├── Changed Files: ⚠️  Could not fetch (likely test repo or PR not found)"
@@ -145,7 +147,7 @@ jobs:
           # Note: sonar-project.properties contains the project-wide exclusions
           if [ -n "$files" ]; then
             inclusions=$(echo "$files" | tr '\n' ',' | sed 's/,$//')
-            echo "SONAR_INCLUSIONS=$inclusions" >> $GITHUB_ENV
+            echo "SONAR_INCLUSIONS=$inclusions" >> "$GITHUB_ENV"
             echo "└── Result: ✅ Will scan $file_count changed file(s)"
           else
             echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
@@ -216,7 +218,7 @@ jobs:
           # Find all downloaded coverage XML files
           coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
           echo "Found coverage files: $coverage_files"
-          echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
+          echo "COVERAGE_PATHS=$coverage_files" >> "$GITHUB_ENV"
 
           echo "🔍 SonarCloud Analysis Summary"
           echo "=============================="

From de256210d769294b7ee1dabb531e228e9690581f Mon Sep 17 00:00:00 2001
From: jessicamack <jmack@redhat.com>
Date: Tue, 28 Jul 2026 10:07:23 -0400
Subject: [PATCH 6/7] more yamllint fixes

---
 .github/workflows/sonarcloud_pr.yml | 227 +++++++++++++++-------------
 1 file changed, 125 insertions(+), 102 deletions(-)

diff --git a/.github/workflows/sonarcloud_pr.yml b/.github/workflows/sonarcloud_pr.yml
index ba11877a..5e23d87f 100644
--- a/.github/workflows/sonarcloud_pr.yml
+++ b/.github/workflows/sonarcloud_pr.yml
@@ -1,13 +1,16 @@
+---
 # SonarCloud Analysis Workflow for awx_plugins.interfaces
 #
-# This workflow runs SonarCloud analysis triggered by CI workflow completion.
-# It is split into two separate jobs for clarity and maintainability:
+# This workflow runs SonarCloud analysis triggered by CI workflow
+# completion. It is split into two separate jobs for clarity and
+# maintainability:
 #
-# FLOW: CI completes → workflow_run triggers this workflow → appropriate job runs
+# FLOW: CI completes → workflow_run triggers → appropriate job runs
 #
 # JOB 1: sonar-pr-analysis (for PRs)
 # - Triggered by: workflow_run (CI on pull_request)
-# - Steps: Download coverage → Get PR info → Get changed files → Run SonarCloud PR analysis
+# - Steps: Download coverage → Get PR info → Get changed files
+#          → Run SonarCloud PR analysis
 # - Scans: All changed files in the PR (Python, YAML, JSON, etc.)
 # - Quality gate: Focuses on new/changed code in PR only
 #
@@ -17,23 +20,28 @@
 # - Scans: Full codebase
 # - Quality gate: Focuses on overall project health
 #
-# This ensures coverage data is always available from CI before analysis runs.
+# This ensures coverage data is always available from CI before
+# analysis runs.
 #
 # What files are scanned:
 # - All files in the repository that SonarCloud can analyze
-# - Excludes: tests, scripts, dev environments, external collections (see sonar-project.properties)
-
+# - Excludes: tests, scripts, dev environments, external
+#   collections (see sonar-project.properties)
 
 # With much help from:
-# https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/30
-# https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/32
+# https://community.sonarsource.com/t/...
+#   how-to-use-sonarcloud-with-a-forked-repository-on-github/
+#   7363/30
+# https://community.sonarsource.com/t/...
+#   how-to-use-sonarcloud-with-a-forked-repository-on-github/
+#   7363/32
 name: SonarCloud
 on:
-  workflow_run:   # This is triggered by CI being completed.
+  workflow_run:  # This is triggered by CI being completed.
     workflows:
-      - CI
+    - CI
     types:
-      - completed
+    - completed
 permissions:
   contents: read
   actions: read
@@ -48,32 +56,34 @@ jobs:
       github.event.workflow_run.event == 'pull_request' &&
       github.repository == 'ansible/awx_plugins.interfaces'
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      # Download all individual coverage artifacts from CI workflow
-      - name: Download coverage artifacts
-        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          workflow: CI
-          run_id: ${{ github.event.workflow_run.id }}
-          pattern: api-test-artifacts
-          if_no_artifact_found: ignore
-          continue-on-error: true
-
-      # Extract PR metadata from workflow_run event
-      - name: Set PR metadata and prepare files for analysis
-        env:
-          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
-          REPO_NAME: ${{ github.event.repository.full_name }}
-          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        persist-credentials: false
+
+    # Download all individual coverage artifacts from CI
+    - name: Download coverage artifacts
+      uses: >-
+        dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        workflow: CI
+        run_id: ${{ github.event.workflow_run.id }}
+        pattern: api-test-artifacts
+        if_no_artifact_found: ignore
+        continue-on-error: true
+
+    # Extract PR metadata from workflow_run event
+    - name: Set PR metadata and prepare files for analysis
+      env:
+        COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
+        REPO_NAME: ${{ github.event.repository.full_name }}
+        HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
           # Find all downloaded coverage XML files
-          coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
+          coverage_files=$(find . -name "coverage.xml" -type f \
+            | tr '\n' ',' | sed 's/,$//')
           echo "Found coverage files: $coverage_files"
           echo "COVERAGE_PATHS=$coverage_files" >> "$GITHUB_ENV"
 
@@ -110,24 +120,27 @@ jobs:
           } >> "$GITHUB_ENV"
 
           # Get all changed files from PR (with error handling)
-          # PR_NUMBER is guaranteed non-empty here (fatal exit above if missing)
+          # PR_NUMBER is guaranteed non-empty here (fatal exit)
           files=""
-          if gh api "repos/$REPO_NAME/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
+          if gh api "repos/$REPO_NAME/pulls/$PR_NUMBER/files" \
+              --paginate --jq '.[].filename' \
+              > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
             files=$(cat /tmp/pr_files.txt)
           else
-            echo "├── Changed Files: ⚠️  Could not fetch (likely test repo or PR not found)"
+            echo "├── Changed Files: ⚠️  Could not fetch"
             if [ -n "$coverage_files" ]; then
               echo "├── Coverage Data: ✅ Available"
             else
               echo "├── Coverage Data: ⚠️  Not available"
             fi
-            echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
+            echo "└── Result: ✅ Running SonarCloud (full scan)"
             # No files = no inclusions filter = full scan
             exit 0
           fi
 
           # Get file extensions and count for summary
-          extensions=$(echo "$files" | sed 's/.*\.//' | sort | uniq | tr '\n' ',' | sed 's/,$//')
+          extensions=$(echo "$files" | sed 's/.*\.//' \
+            | sort | uniq | tr '\n' ',' | sed 's/,$//')
           file_count=$(echo "$files" | wc -l)
           echo "├── Changed Files: $file_count file(s) (.${extensions})"
 
@@ -135,7 +148,7 @@ jobs:
           if [ -f coverage.xml ] && [ -s coverage.xml ]; then
             echo "├── Coverage Data: ✅ Available"
           else
-            echo "├── Coverage Data: ⚠️  Not available (analysis will proceed without coverage)"
+            echo "├── Coverage Data: ⚠️  Not available"
           fi
 
           # Prepare file list for Sonar
@@ -150,40 +163,45 @@ jobs:
             echo "SONAR_INCLUSIONS=$inclusions" >> "$GITHUB_ENV"
             echo "└── Result: ✅ Will scan $file_count changed file(s)"
           else
-            echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
+            echo "└── Result: ✅ Running SonarCloud (full scan)"
           fi
 
-      - name: Prepare repository for PR analysis
-        if: env.PR_NUMBER != ''
-        run: |
-          # Validate PR_NUMBER is numeric to prevent command injection
-          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
-            echo "##[error]Invalid PR number: $PR_NUMBER"
-            exit 1
-          fi
+    - name: Prepare repository for PR analysis
+      if: env.PR_NUMBER != ''
+      run: |
+        # Validate PR_NUMBER is numeric to prevent command injection
+        if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+          echo "##[error]Invalid PR number: $PR_NUMBER"
+          exit 1
+        fi
 
-          # Fetch the PR branch for SonarCloud PR analysis comparison
-          git fetch origin "$PR_BASE"
-
-          # Checkout the exact commit that CI tested, not the current PR head
-          # This ensures SonarCloud analyzes the same code that CI validated
-          git checkout "$COMMIT_SHA"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
-        with:
-          args: >
+        # Fetch the PR branch for SonarCloud PR analysis
+        git fetch origin "$PR_BASE"
+
+        # Checkout the exact commit that CI tested
+        # This ensures SonarCloud analyzes CI-validated code
+        git checkout "$COMMIT_SHA"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: SonarCloud Scan
+      uses: >-
+        SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
+      with:
+        args: >
             -Dsonar.scm.revision=${{ env.COMMIT_SHA }}
             -Dsonar.pullrequest.key=${{ env.PR_NUMBER }}
             -Dsonar.pullrequest.branch=${{ env.PR_HEAD }}
             -Dsonar.pullrequest.base=${{ env.PR_BASE }}
-            ${{ env.COVERAGE_PATHS && format('-Dsonar.python.coverage.reportPaths={0}', env.COVERAGE_PATHS) || '' }}
-            ${{ env.SONAR_INCLUSIONS && format('-Dsonar.inclusions={0}', env.SONAR_INCLUSIONS) || '' }}
+            ${{ env.COVERAGE_PATHS &&
+            format('-Dsonar.python.coverage.reportPaths={0}',
+            env.COVERAGE_PATHS) || '' }}
+            ${{ env.SONAR_INCLUSIONS &&
+            format('-Dsonar.inclusions={0}',
+            env.SONAR_INCLUSIONS) || '' }}
 
   sonar-branch-analysis:
     name: SonarCloud Branch Analysis
@@ -195,28 +213,30 @@ jobs:
       github.event.workflow_run.event == 'push' &&
       github.repository == 'ansible/awx_plugins.interfaces'
     steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      # Download all individual coverage artifacts from CI workflow (optional for branch pushes)
-      - name: Download coverage artifacts
-        continue-on-error: true
-        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          workflow: CI
-          run_id: ${{ github.event.workflow_run.id }}
-          pattern: api-test-artifacts
-
-      - name: Print SonarCloud Analysis Summary
-        env:
-          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
-        run: |
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.workflow_run.head_sha }}
+        fetch-depth: 0
+        persist-credentials: false
+
+    # Download all coverage artifacts from CI (optional)
+    - name: Download coverage artifacts
+      continue-on-error: true
+      uses: >-
+        dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        workflow: CI
+        run_id: ${{ github.event.workflow_run.id }}
+        pattern: api-test-artifacts
+
+    - name: Print SonarCloud Analysis Summary
+      env:
+        BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
+      run: |
           # Find all downloaded coverage XML files
-          coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
+          coverage_files=$(find . -name "coverage.xml" -type f \
+            | tr '\n' ',' | sed 's/,$//')
           echo "Found coverage files: $coverage_files"
           echo "COVERAGE_PATHS=$coverage_files" >> "$GITHUB_ENV"
 
@@ -225,16 +245,19 @@ jobs:
           echo "├── CI Event: ✅ Push (via workflow_run)"
           echo "├── Branch: $BRANCH_NAME"
           echo "├── Coverage Files: ${coverage_files:-none}"
-          echo "├── Python Changes: ➖ N/A (Full codebase scan)"
-          echo "└── Result: ✅ Proceed - \"Running SonarCloud analysis\""
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
-        with:
-          args: >
+          echo "├── Python Changes: ➖ N/A (Full scan)"
+          echo "└── Result: ✅ Proceed - Running SonarCloud"
+
+    - name: SonarCloud Scan
+      uses: >-
+        SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
+      with:
+        args: >
             -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
             -Dsonar.branch.name=${{ github.event.workflow_run.head_branch }}
-            ${{ env.COVERAGE_PATHS && format('-Dsonar.python.coverage.reportPaths={0}', env.COVERAGE_PATHS) || '' }}
+            ${{ env.COVERAGE_PATHS &&
+            format('-Dsonar.python.coverage.reportPaths={0}',
+            env.COVERAGE_PATHS) || '' }}

From 1df2b594c512e1e7d276ee997d01e8ca2f369862 Mon Sep 17 00:00:00 2001
From: jessicamack <jmack@redhat.com>
Date: Tue, 28 Jul 2026 11:05:33 -0400
Subject: [PATCH 7/7] fix CI name

---
 .github/workflows/sonarcloud_pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sonarcloud_pr.yml b/.github/workflows/sonarcloud_pr.yml
index 5e23d87f..0ae85a05 100644
--- a/.github/workflows/sonarcloud_pr.yml
+++ b/.github/workflows/sonarcloud_pr.yml
@@ -39,7 +39,7 @@ name: SonarCloud
 on:
   workflow_run:  # This is triggered by CI being completed.
     workflows:
-    - CI
+    - "🧪"
     types:
     - completed
 permissions: