From 3b8784786cf31fea38491e898547b1efc13fbff0 Mon Sep 17 00:00:00 2001
From: Travis <travis.lyons@sourcegraph.com>
Date: Tue, 15 Sep 2026 16:26:56 +0000
Subject: [PATCH] Build: add a project-specific SonarQube scan for each
 sub-module

Declares the org.sonarqube plugin in the root build and applies a new
gradle/sonar.gradle convention to every spring-* module so each one is
analyzed as its own SonarQube project keyed org.springframework:<module>,
instead of a single aggregated scan of the whole build.

Adds .github/workflows/sonar.yml, a matrix workflow running one scan job
per sub-module. Server URL and token are read from the SONAR_HOST_URL and
SONAR_TOKEN environment variables rather than being hardcoded.
---
 .github/workflows/sonar.yml | 56 +++++++++++++++++++++++++++++++++++++
 build.gradle                |  2 ++
 gradle/sonar.gradle         | 11 ++++++++
 3 files changed, 69 insertions(+)
 create mode 100644 .github/workflows/sonar.yml
 create mode 100644 gradle/sonar.gradle

diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 000000000000..26ba527f0796
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,56 @@
+name: SonarQube
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  sonar:
+    name: SonarQube (${{ matrix.module }})
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - spring-aop
+          - spring-aspects
+          - spring-beans
+          - spring-context
+          - spring-context-indexer
+          - spring-context-support
+          - spring-core
+          - spring-core-test
+          - spring-expression
+          - spring-instrument
+          - spring-jdbc
+          - spring-jms
+          - spring-messaging
+          - spring-orm
+          - spring-oxm
+          - spring-r2dbc
+          - spring-test
+          - spring-tx
+          - spring-web
+          - spring-webflux
+          - spring-webmvc
+          - spring-websocket
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.module }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare Gradle Build
+        uses: ./.github/actions/prepare-gradle-build
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          java-distribution: 'liberica'
+          java-early-access: 'false'
+          java-toolchain: 'false'
+          java-version: '25'
+      - name: Test and Scan
+        env:
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: ./gradlew :${{ matrix.module }}:test :${{ matrix.module }}:sonar
diff --git a/build.gradle b/build.gradle
index 7b78a1fd03a6..0ec1f88ced5f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -7,6 +7,7 @@ plugins {
 	id 'com.gradleup.shadow' version "9.2.2" apply false
 	id 'me.champeau.jmh' version '0.7.2' apply false
 	id 'io.spring.nullability' version '0.0.15' apply false
+	id 'org.sonarqube' version '7.4.0.8496' apply false
 }
 
 ext {
@@ -79,4 +80,5 @@ configure([rootProject] + javaProjects) { project ->
 
 configure(moduleProjects) { project ->
 	apply from: "${rootDir}/gradle/spring-module.gradle"
+	apply from: "${rootDir}/gradle/sonar.gradle"
 }
diff --git a/gradle/sonar.gradle b/gradle/sonar.gradle
new file mode 100644
index 000000000000..76ab5d3ecc36
--- /dev/null
+++ b/gradle/sonar.gradle
@@ -0,0 +1,11 @@
+// Configures standalone per-module SonarQube projects when applied from the root build.
+apply plugin: 'org.sonarqube'
+
+sonar {
+	properties {
+		property 'sonar.projectKey', "org.springframework:${project.name}"
+		property 'sonar.projectName', project.description ?: project.name
+		property 'sonar.projectVersion', project.version
+		property 'sonar.sourceEncoding', 'UTF-8'
+	}
+}