From 79b517e83b50e9ce4bcb572c80ae0a3dff7b40d8 Mon Sep 17 00:00:00 2001
From: Ellie Bound <175816742+ellie-bound1-NHSD@users.noreply.github.com>
Date: Wed, 12 Aug 2026 11:42:29 +0100
Subject: [PATCH 1/4] NPA-7116: Add Sonar cloud scanning for sandbox only

---
 .github/workflows/sonarcloud.yml | 22 ++++++++++++++++++++++
 sonar-project.properties         |  4 ++++
 2 files changed, 26 insertions(+)
 create mode 100644 .github/workflows/sonarcloud.yml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
new file mode 100644
index 00000000..155bd190
--- /dev/null
+++ b/.github/workflows/sonarcloud.yml
@@ -0,0 +1,22 @@
+name: SonarCloud Analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  sonarcloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 00000000..e819a746
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,4 @@
+sonar.projectKey=NHSDigital_validated-relationships-service-api
+sonar.organization=nhsdigital
+sonar.exclusions=**/node_modules/**,**/dist/**,**/tests/**
+sonar.sources=sandbox 

From aead2ef543d744ecec9bba028fdb606a31462ff7 Mon Sep 17 00:00:00 2001
From: ellie-bound1-NHSD <175816742+ellie-bound1-NHSD@users.noreply.github.com>
Date: Mon, 17 Aug 2026 11:00:10 +0100
Subject: [PATCH 2/4] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 sonar-project.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sonar-project.properties b/sonar-project.properties
index e819a746..0cb16c0d 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,4 +1,4 @@
 sonar.projectKey=NHSDigital_validated-relationships-service-api
 sonar.organization=nhsdigital
 sonar.exclusions=**/node_modules/**,**/dist/**,**/tests/**
-sonar.sources=sandbox 
+sonar.sources=sandbox

From bc22cb674630ee4e3d07110198d4fc9a6e133406 Mon Sep 17 00:00:00 2001
From: Ellie Bound <175816742+ellie-bound1-NHSD@users.noreply.github.com>
Date: Mon, 17 Aug 2026 11:01:45 +0100
Subject: [PATCH 3/4] NPA-7116: Correct branch set for on push and pr

---
 .github/workflows/sonarcloud.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 155bd190..6b3e4b78 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -3,8 +3,10 @@ name: SonarCloud Analysis
 on:
   push:
     branches:
-      - main
+      - master
   pull_request:
+    branches:
+      - master
     types: [opened, synchronize, reopened]
 
 jobs:

From b3e7cd91387df82119a680b335bd9e12af01b0d7 Mon Sep 17 00:00:00 2001
From: Ellie Bound <175816742+ellie-bound1-NHSD@users.noreply.github.com>
Date: Mon, 17 Aug 2026 11:10:10 +0100
Subject: [PATCH 4/4] NPA-7116: Add python version to sonar properties to get
 more precise analysis

---
 sonar-project.properties | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sonar-project.properties b/sonar-project.properties
index 0cb16c0d..a5d5c12e 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -2,3 +2,4 @@ sonar.projectKey=NHSDigital_validated-relationships-service-api
 sonar.organization=nhsdigital
 sonar.exclusions=**/node_modules/**,**/dist/**,**/tests/**
 sonar.sources=sandbox
+sonar.python.version=3.13
\ No newline at end of file