[PM-7288] Include changes to actions in scan workflow (#87)

.github/workflows/scan.yml

@@ -40,12 +40,15 @@ jobs:
           base_uri: https://ast.checkmarx.net/
           cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
           cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
-          # additional_params: --report-format sarif --output-path . ${{ env.INCREMENTAL }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path . ${{ env.INCREMENTAL }}
 
-      # - name: Upload Checkmarx results to GitHub
-      #   uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
-      #   with:
-      #     sarif_file: cx_result.sarif
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
+        with:
+          sarif_file: cx_result.sarif
 
   quality:
     name: Quality scan
@@ -68,8 +71,7 @@ jobs:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          # TODO: see https://docs.sonarsource.com/sonarcloud/advanced-setup/analysis-parameters/
-          # for parameters to configure
           args: >
             -Dsonar.organization=${{ github.repository_owner }}
             -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
+

app/build.gradle.kts

@@ -8,6 +8,7 @@ plugins {
     alias(libs.plugins.kotlinx.kover)
     alias(libs.plugins.ksp)
     alias(libs.plugins.google.services)
+    alias(libs.plugins.sonarqube)
 }
 
 android {
@@ -127,3 +128,19 @@ dependencies {
 
     androidTestImplementation(libs.bundles.tests.instrumented)
 }
+
+sonar {
+    properties {
+        property("sonar.projectKey", "bitwarden_authenticator-android")
+        property("sonar.organization", "bitwarden")
+        property("sonar.host.url", "https://sonarcloud.io")
+        property("sonar.sources", "src/main/,src/debug/")
+        property("sonar.tests", "src/test/")
+    }
+}
+
+tasks {
+    getByName("sonar") {
+        dependsOn("check")
+    }
+} 

build.gradle.kts

@@ -7,4 +7,5 @@ plugins {
     alias(libs.plugins.kotlinx.kover) apply false
     alias(libs.plugins.ksp) apply false
     alias(libs.plugins.google.services) apply false
-}
+    alias(libs.plugins.sonarqube) apply false
+}

gradle/libs.versions.toml

@@ -51,6 +51,7 @@ okhttp = "4.12.0"
 retrofit = "2.11.0"
 retrofitKotlinxSerialization = "1.0.0"
 roboelectric = "4.12.1"
+sonarqube = "5.0.0.4638" 
 turbine = "1.1.0"
 zxing = "3.5.3"
 
@@ -127,6 +128,7 @@ kotlin-parcelize = { id = "org.jetbrains.kotlin.plugin.parcelize", version.ref =
 kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" }
 kotlinx-kover = { id = "org.jetbrains.kotlinx.kover", version.ref = "kotlinxKover" }
 ksp = { id = "com.google.devtools.ksp", version.ref = "ksp" }
+sonarqube = { id = "org.sonarqube", version.ref = "sonarqube" }
 
 [bundles]
 tests-instrumented = [