Running checks for PR #1153 (NRL-1948 use new permission model) #48

	name: Run PR checks
	run-name: "Running checks for PR #${{ github.event.pull_request.number }} (${{ github.event.pull_request.title }})"

	on:
	pull_request:
	types: [opened, reopened, synchronize]

	jobs:
	build:
	name: Build and test
	runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
	environment: pull-request
	permissions:
	contents: read
	actions: write

	steps:
	- name: Git clone - ${{ github.ref }}
	uses: actions/checkout@v4
	with:
	ref: ${{ github.ref }}

	- name: Setup environment
	run: \|
	echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
	poetry install --no-root

	- name: Lint
	run: make lint

	- name: Build
	run: make build

	- name: Test
	run: make test

	- name: Upload build artifacts
	uses: actions/upload-artifact@v4
	with:
	name: build-artifacts
	path: dist

	sonar:
	name: SonarQube scan
	runs-on: ubuntu-latest
	needs: build
	environment: pull-request
	permissions:
	contents: read
	actions: write
	steps:
	- uses: actions/checkout@v4
	with:
	ref: ${{ github.ref }}

	- name: Get build artifacts
	uses: actions/download-artifact@v4
	with:
	name: build-artifacts
	path: dist

	- name: SonarQube scan
	uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 #v7.0.0
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

	- name: SonarQube quality gate check
	id: sonarqube-quality-gate-check
	uses: sonarsource/sonarqube-quality-gate-action@cf038b0e0cdecfa9e56c198bbb7d21d751d62c3b #v1.2.0
	with:
	pollingTimeoutSec: 600
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Provide feedback