ci: add NiCE SonarQube analysis (AB#142804)

[Lucas Ramos (ls-ramos)]

Summary

• Onboards this repo onto the NiCE corporate SonarQube instance (sonar.nice.com) per the org rollout tracked under AB#142804.
• Adds .github/workflows/sonarqube.yml using the org-level NICE_SONAR_TOKEN / NICE_SONAR_HOST_URL.
• Adds/updates sonar-project.properties with projectKey com.nice.cognigy-boron-SocketClient (team confirmed via GitHub Team/topic metadata and the Domain Ownership List).

Changelog

• [internal] Improved by adding NiCE SonarQube analysis to CI, so code quality, security findings and coverage for SocketClient are reported on every push and pull request.

Reference: Using NiCE SonarQube

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR onboards the SocketClient repository to the NiCE corporate SonarQube instance by adding a GitHub Actions workflow to run the SonarQube scan and introducing a sonar-project.properties file to define the project identity and analysis scope.

Changes:

• Adds sonar-project.properties with a new SonarQube projectKey and source/test include/exclude configuration.
• Adds a GitHub Actions workflow to run SonarSource/sonarqube-scan-action using NICE_SONAR_TOKEN and NICE_SONAR_HOST_URL.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
sonar-project.properties	Defines SonarQube project identity plus source/test inclusion and exclusion patterns.
.github/workflows/sonarqube.yml	Adds a CI workflow that checks out the repo and runs the SonarQube scan action using org-provided credentials.

Suppressed comments (1)

.github/workflows/sonarqube.yml:25

• SonarSource/sonarqube-scan-action is pinned to @v7, but the latest release line is now in the v8 major series. Updating the major pin reduces the risk of missing important scanner/runner compatibility and bug fixes.

      - uses: SonarSource/sonarqube-scan-action@v7

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Vijayakrishna Venkatesan (vj-venkatesan)]

Lucas Ramos (@ls-ramos) In this project you might also want to merge this to another branch https://github.com/Cognigy/SocketClient/tree/v5-for-webchat-v3

Dmitrii Ostasevich (@kwinto) Correct me If am wrong

[Sushmitha Sekar (sushmi21)]

Lucas Ramos (Lucas Ramos (@ls-ramos)) In this project you might also want to merge this to another branch https://github.com/Cognigy/SocketClient/tree/v5-for-webchat-v3

Yes, it is a valid point.