build-test-sonar lags ploch-common's SonarCloud configuration: no project version, no coverage exclusions, narrow coverage glob, hard-fails on fork PRs

[kploch]

Problem

build-test-sonar/action.yml and the inline SonarCloud configuration in ploch-common/.github/workflows/build-dotnet.yml have diverged. ploch-common stopped consuming the shared action and grew a better configuration inline; every repo still on build-test-sonar@main gets the weaker one.

Five concrete gaps:

1. No /v: project version

ploch-common derives the version from NBGV and passes /v:"$NUGET_VERSION". Without it, SonarCloud's "Previous version" new-code definition has no version history to diff against and treats the entire baseline as new code on every analysis — making the new-code quality gate meaningless. (This was the fix for mrploch/ploch-common#222.)

2. No coverage exclusions

ploch-common passes:

/d:sonar.coverage.exclusions="**/*.ps1,**/JetbrainsAnnotations.cs,**/*.Tests/**,**/*.Tests.csproj,scripts/**,**/TestAssemblies/**"

The shared action passes none, so test projects and scripts are scored as uncovered production code and drag the coverage percentage down.

3. Coverage report glob is too narrow

The action uses an exact filename:

/d:sonar.cs.opencover.reportsPaths=**/CoverageResults/coverage.opencover.xml

ploch-common uses coverage*.opencover.xml. With multi-project solutions Coverlet emits per-assembly files (coverage.<Assembly>.opencover.xml), which the exact-name pattern silently misses — coverage is then under-reported with no error.

4. Missing SCM/base-dir hints

ploch-common sets sonar.scm.provider=git and sonar.projectBaseDir. Without an explicit SCM provider the scanner has to auto-detect blame data, which drives new-code attribution.

5. Hard-fails on fork and Dependabot PRs

The Validate SonarCloud Token step (added in #3) exits 1 on an empty token. That is correct for a misconfigured repo, but on a fork or Dependabot PR the secret is legitimately unavailable, so the whole action fails and the PR gets a red check — and, worse, the build and test steps never run.

Analysis should be skipped with a warning in that case while build and test still run. Compare ploch-ai-configuration, which already guards with github.event.pull_request.head.repo.full_name == github.repository.

Proposed changes

• Add optional sonar-project-version input → /v:.
• Add optional sonar-coverage-exclusions input, defaulting to ploch-common's list.
• Broaden the coverage glob to coverage*.opencover.xml.
• Add sonar.scm.provider=git and sonar.projectBaseDir.
• Compute a sonar-enabled flag: skip the scanner steps (with a warning) when the token is absent and the event is a fork PR; keep the hard error when the token is absent on a same-repo run. Build and test run unconditionally.

Out of scope

• Pinning third-party actions to SHAs — tracked separately in Pin third-party actions to commit SHAs and add Dependabot for action updates #2.
• Migrating ploch-common back onto the shared action.

Related

• Depends on fix(build-test-sonar)!: Authenticate Sonar scanner with sonar.token #3 (merged) for the sonar.token migration.
• Companion issue in ploch-common for the continue-on-error masking and the leftover sonar.login usage.