Add SonarQube code quality analysis workflow

[bernardladenthin]

Summary

• Add GitHub Actions workflow for SonarQube code quality analysis on push to main and pull requests
• Configure SonarQube organization in pom.xml to enable integration with SonarQube Cloud
• Workflow includes caching for SonarQube and Maven packages to improve CI performance

Test plan

• CI is green on this branch

Related issues / PRs

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

https://claude.ai/code/session_012WHHfb7tuYQkFz1YQ1BRmd

[claude]

Missing SPDX headers. Other workflows in this repo include SPDX copyright and license headers (e.g., codeql.yml, reuse.yml). Add:

Suggested change

	name: SonarQube
	on:
	push:
	branches:
	- main
	pull_request:
	types: [opened, synchronize, reopened]
	# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
	# SPDX-FileCopyrightText: 2023-2025 Konstantin Herud
	#
	# SPDX-License-Identifier: MIT
	name: SonarQube
	on:
	push:
	branches:
	- main
	pull_request:
	types: [opened, synchronize, reopened]

[claude]

Inconsistent action version pinning: This workflow uses full commit SHAs for some actions while other workflows in the repo use semantic versioning (@v6, @v5, etc.). For consistency and maintainability, consider using the same pattern as established workflows in this repo. Either:

1. Update to use @v4 semver tags (simpler, follows other workflows), or
2. Document why this workflow requires stricter pinning via commit SHA

Examples from other workflows:

• codeql.yml: uses @v4, @v6, @v5
• reuse.yml: uses @v6
• publish.yml: uses @v7, @v8, etc.

[claude]

Missing error handling: The workflow runs mvn verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar but doesn't check if SONAR_TOKEN is actually set. If the secret is not configured, the Maven command will fail silently or with unclear errors. Consider adding a check or documenting this dependency:

Suggested change

	- name: Build and analyze
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=bernardladenthin_java-llama.cpp
	- name: Build and analyze
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	run: |
	if [ -z "$SONAR_TOKEN" ]; then
	echo "Warning: SONAR_TOKEN not set, skipping SonarQube analysis"
	mvn -B verify
	else
	mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=bernardladenthin_java-llama.cpp
	fi

Alternatively, document in the PR body or README that this workflow requires the SONAR_TOKEN secret to be configured for the repository.

[claude]

This PR adds SonarQube Cloud integration. Review findings posted as inline comments on the diff. Key issues:

1. Missing SPDX headers (consistency - other workflows have them)
2. Inconsistent action pinning (commit SHAs vs semver tags used elsewhere)
3. No SONAR_TOKEN secret validation

What works well: Cache setup, fetch-depth for analysis, good trigger configuration.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud