From 2906b780a7968be5ae91a6f520725b3672821e29 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Thu, 15 Oct 2026 19:14:11 +0000
Subject: [PATCH 1/2] ci: analyze source with SonarQube Cloud

---
 .github/workflows/sonar.yml | 31 +++++++++++++++++++++++++++++++
 README.md                   |  2 ++
 sonar-project.properties    | 13 +++++++++++++
 3 files changed, 46 insertions(+)
 create mode 100644 .github/workflows/sonar.yml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 0000000..8aad74c
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,31 @@
+name: SonarQube
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonar-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analysis:
+    name: SonarQube analysis
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: -Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=300
diff --git a/README.md b/README.md
index 0a2765e..97016c0 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # Durable Workflow Python SDK
 
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=durable-workflow_sdk-python&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=durable-workflow_sdk-python)
+
 [![CI](https://github.com/durable-workflow/sdk-python/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/durable-workflow/sdk-python/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/durable-workflow.svg)](https://pypi.org/project/durable-workflow/)
 [![Python](https://img.shields.io/pypi/pyversions/durable-workflow.svg)](https://pypi.org/project/durable-workflow/)
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..710b2d8
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,13 @@
+sonar.organization=durable-workflow
+sonar.projectKey=durable-workflow_sdk-python
+sonar.projectName=sdk-python
+sonar.sourceEncoding=UTF-8
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=tests/**,**/tests/**,**/*.test.*,**/*.spec.*,**/test_*.py,benchmarks/**,scripts/conformance/**
+# Dependencies, generated assets and disposable runtime/build output are not source.
+sonar.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/dist/**,**/build/**,**/storage/**,**/.venv/**,**/__pycache__/**,**/coverage/**,**/.scannerwork/**,**/.git/**,static/vendor/**,public/vendor/**,resources/js/vendor/**
+sonar.test.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/.venv/**
+# Existing repository test and coverage gates remain required; do not fabricate reports.
+sonar.sca.enabled=false
+sonar.python.version=3.10,3.11,3.12,3.13,3.14

From c3383f1db5990eb1f93aab56e4cb6ab0b87f25e1 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Thu, 15 Oct 2026 19:24:36 +0000
Subject: [PATCH 2/2] ci: keep uncollected coverage distinct from static
 analysis

---
 sonar-project.properties | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sonar-project.properties b/sonar-project.properties
index 710b2d8..7dc3927 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -8,6 +8,8 @@ sonar.test.inclusions=tests/**,**/tests/**,**/*.test.*,**/*.spec.*,**/test_*.py,
 # Dependencies, generated assets and disposable runtime/build output are not source.
 sonar.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/dist/**,**/build/**,**/storage/**,**/.venv/**,**/__pycache__/**,**/coverage/**,**/.scannerwork/**,**/.git/**,static/vendor/**,public/vendor/**,resources/js/vendor/**
 sonar.test.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/.venv/**
-# Existing repository test and coverage gates remain required; do not fabricate reports.
+# This CI job performs static analysis. Repository test/coverage gates stay required.
+# No coverage report is collected here; leave that metric unmeasured in Sonar.
+sonar.coverage.exclusions=**/*
 sonar.sca.enabled=false
 sonar.python.version=3.10,3.11,3.12,3.13,3.14