chore: add SonarQube quality checks

.github/workflows/sonarqube.yml

@@ -0,0 +1,47 @@
+name: Test and SonarQube
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          # Full history so SonarQube can read blame data for new-code detection.
+          fetch-depth: 0
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Lint
+        run: npm run lint
+
+      - name: SonarQube scan
+        uses: SonarSource/sonarqube-scan-action@v8.1.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+        with:
+          args: >-
+            -Dsonar.projectKey=My-Weekly-ToDo-List
+            -Dsonar.sources=src,scripts
+            -Dsonar.exclusions=**/node_modules/**,**/.next/**,**/*.spec.ts
+            -Dsonar.qualitygate.wait=true
+            -Dsonar.qualitygate.timeout=300

.gitignore

@@ -46,4 +46,8 @@ certificates
 docs/design/
 
 # Dokumentationen (nicht tracken)
-APP_ERKLÄRUNG.md
+APP_ERKLÄRUNG.md
+SONARQUBE-LLM-GUIDE.md
+
+# SonarQube scanner working directory
+.scannerwork/

package.json

@@ -9,7 +9,8 @@
     "start": "echo \"\\n  ✦ My Weekly ToDo List v$(node -p \"require('./package.json').version\") — production\\n\" && next start",
     "lint": "next lint",
     "type-check": "tsc --noEmit",
-    "test": "jest"
+    "test": "jest",
+    "sonar": "todo-sonar-scan"
   },
   "keywords": [
     "nextjs",

sonar-project.properties

@@ -0,0 +1,13 @@
+# SonarQube Community Build — local analysis config.
+# Run with:  SONAR_TOKEN=<your token> sonar-scanner
+# The token is NEVER stored here; it comes from the environment.
+
+sonar.projectKey=mARTin-B78_My-Weekly-ToDo-List_e038f066-0063-4a1e-9c33-03fdd5ab3c3a
+sonar.projectName=My-Weekly-ToDo-List
+sonar.host.url=https://sq.martin-bierschenk.de
+
+# "Version 01/" is a tracked copy of the superseded app; scanning it would
+# flood the Quality Gate with duplicates of code that is no longer shipped.
+sonar.sources=src,scripts
+sonar.sourceEncoding=UTF-8
+sonar.exclusions=**/node_modules/**,**/.next/**,**/*.spec.ts,**/*.test.ts