From c120a0ad7faae8806f3e3d370c9c6570a31137e9 Mon Sep 17 00:00:00 2001
From: mARTin-B78 <mail@martin-bierschenk.de>
Date: Thu, 3 Sep 2026 16:24:41 +0200
Subject: [PATCH] chore: add SonarQube quality checks

---
 .github/workflows/sonarqube.yml | 47 +++++++++++++++++++++++++++++++++
 .gitignore                      |  6 ++++-
 package.json                    |  3 ++-
 sonar-project.properties        | 13 +++++++++
 4 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/sonarqube.yml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
new file mode 100644
index 0000000..4ae8cb2
--- /dev/null
+++ b/.github/workflows/sonarqube.yml
@@ -0,0 +1,47 @@
+name: Test and SonarQube
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          # Full history so SonarQube can read blame data for new-code detection.
+          fetch-depth: 0
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Lint
+        run: npm run lint
+
+      - name: SonarQube scan
+        uses: SonarSource/sonarqube-scan-action@v8.1.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+        with:
+          args: >-
+            -Dsonar.projectKey=My-Weekly-ToDo-List
+            -Dsonar.sources=src,scripts
+            -Dsonar.exclusions=**/node_modules/**,**/.next/**,**/*.spec.ts
+            -Dsonar.qualitygate.wait=true
+            -Dsonar.qualitygate.timeout=300
diff --git a/.gitignore b/.gitignore
index 1ce5c4f..4518359 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,4 +46,8 @@ certificates
 docs/design/
 
 # Dokumentationen (nicht tracken)
-APP_ERKLÄRUNG.md
\ No newline at end of file
+APP_ERKLÄRUNG.md
+SONARQUBE-LLM-GUIDE.md
+
+# SonarQube scanner working directory
+.scannerwork/
diff --git a/package.json b/package.json
index f4aeba4..81e4236 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,8 @@
     "start": "echo \"\\n  ✦ My Weekly ToDo List v$(node -p \"require('./package.json').version\") — production\\n\" && next start",
     "lint": "next lint",
     "type-check": "tsc --noEmit",
-    "test": "jest"
+    "test": "jest",
+    "sonar": "todo-sonar-scan"
   },
   "keywords": [
     "nextjs",
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..6592945
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,13 @@
+# SonarQube Community Build — local analysis config.
+# Run with:  SONAR_TOKEN=<your token> sonar-scanner
+# The token is NEVER stored here; it comes from the environment.
+
+sonar.projectKey=mARTin-B78_My-Weekly-ToDo-List_e038f066-0063-4a1e-9c33-03fdd5ab3c3a
+sonar.projectName=My-Weekly-ToDo-List
+sonar.host.url=https://sq.martin-bierschenk.de
+
+# "Version 01/" is a tracked copy of the superseded app; scanning it would
+# flood the Quality Gate with duplicates of code that is no longer shipped.
+sonar.sources=src,scripts
+sonar.sourceEncoding=UTF-8
+sonar.exclusions=**/node_modules/**,**/.next/**,**/*.spec.ts,**/*.test.ts