chore: add SonarQube code analysis configuration

.github/workflows/sonar.yaml

@@ -0,0 +1,32 @@
+on:
+  # trigger analysis for pushes and pull requests
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+name: SonarQube Main Workflow
+
+jobs:
+  sonarqube:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # fetch full history for better SCM information
+          fetch-depth: 0
+
+      - name: Run SonarQube Scan
+        uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+
+      - name: Quality Gate check
+        uses: sonarsource/sonarqube-quality-gate-action@master
+        timeout-minutes: 5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

sonar-project.properties

@@ -0,0 +1,21 @@
+# Server and project configuration
+# Note: SONAR_HOST_URL secret in the workflow takes precedence at scan time.
+# This entry documents the expected host and is a no-op when the secret is set.
+sonar.host.url=https://sonar.wpengine.io/
+sonar.projectVersion=1.0
+sonar.sourceEncoding=UTF-8
+sonar.scm.provider=git
+
+# Project Identifiers
+sonar.projectName=local-addon-notes
+sonar.projectKey=getflywheel_local-addon-notes_353f0d7e-470a-455f-9210-df9fd02b6013
+
+# Paths to source code directories and files (relative paths)
+sonar.sources=src,style.css,assets
+
+# Exclusions - test files + vendor/build dirs + auto-generated code
+sonar.exclusions=**/*.test.*,**/*.spec.*,node_modules/**,lib/**,dist/**,build/**,coverage/**,.nyc_output/**
+
+# Paths to test source directories (relative paths)
+sonar.tests=src
+sonar.test.inclusions=**/*.test.*,**/*.spec.*