Update GitHub Actions workflow for build and analysis

[Blizzardo1]

Summary by Sourcery

Update the GitHub Actions build workflow to use pinned action versions, adjust SonarQube caching to use the runner temp directory, and align the scanner configuration and build command with the current Sonar project.

Build:

• Pin checkout, setup-java, and cache actions to specific commit SHAs in the build workflow.
• Change SonarQube cache and scanner directories to use the runner temp path instead of workspace-relative folders.
• Update SonarQube project key and switch the build step to run a solution-wide 'dotnet build' instead of targeting a specific project.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the Windows build-and-analyze GitHub Actions workflow by pinning action versions to specific SHAs, adjusting cache locations to use the runner’s temp directory, updating SonarQube project key and build command, and simplifying branch triggers.

File-Level Changes

Change	Details	Files
Pin workflow actions to specific commit SHAs for reproducible CI runs.	Pin actions/checkout to a specific v4.3.1 commit SHA. Pin actions/setup-java to a specific v4.8.0 commit SHA. Pin actions/cache (both usages) to a specific v4.3.0 commit SHA.	.github/workflows/build.yml
Adjust SonarQube caching and scanner installation to use runner.temp instead of repo-local .sonar paths.	Change SonarQube cache path from a user home .sonar directory to a directory under runner.temp. Change scanner cache path from ./.sonar/scanner to a directory under runner.temp. Update PowerShell commands that create the scanner directory and install dotnet-sonarscanner to target runner.temp paths. Update sonar scanner executable path in the build-and-analyze step to match the new runner.temp location.	.github/workflows/build.yml
Update SonarQube analysis configuration and build behavior and restrict workflow triggers.	Remove the dev branch from the workflow push trigger so the workflow runs only on main. Change the SonarQube project key used in the scanner begin command to a new key value. Simplify the dotnet build invocation from targeting a specific project file to building the default solution/project in the repo.	.github/workflows/build.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 2 issues, and left some high level feedback:

• The SonarQube cache path was changed from ~\.sonar\cache to ${{ runner.temp }}\cache, but the scanner itself will still default to using the .sonar directory under the user home; consider aligning the cache path with the actual directory the scanner uses so the cache is effective.
• The SonarQube project key is now hard-coded to Blizzardo1_SharpSDL3_2f21dd8f-7c45-448a-88e7-addecd7a4565; consider moving this to a reusable variable or secret (e.g., workflow env or repository secret) to make future changes safer and reduce leakage of internal identifiers.
• The build step was changed from dotnet build SDL3\SharpSDL3.csproj to dotnet build, which may cause additional projects or configurations to be built; if that’s not intended, consider explicitly targeting the desired solution or project file.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The SonarQube cache path was changed from `~\.sonar\cache` to `${{ runner.temp }}\cache`, but the scanner itself will still default to using the `.sonar` directory under the user home; consider aligning the cache path with the actual directory the scanner uses so the cache is effective.
- The SonarQube project key is now hard-coded to `Blizzardo1_SharpSDL3_2f21dd8f-7c45-448a-88e7-addecd7a4565`; consider moving this to a reusable variable or secret (e.g., workflow env or repository secret) to make future changes safer and reduce leakage of internal identifiers.
- The build step was changed from `dotnet build SDL3\SharpSDL3.csproj` to `dotnet build`, which may cause additional projects or configurations to be built; if that’s not intended, consider explicitly targeting the desired solution or project file.

## Individual Comments

### Comment 1
<location path=".github/workflows/build.yml" line_range="46" />
<code_context>
-          dotnet build SDL3\SharpSDL3.csproj
-          .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
+          ${{ runner.temp }}\scanner\dotnet-sonarscanner begin /k:"Blizzardo1_SharpSDL3_2f21dd8f-7c45-448a-88e7-addecd7a4565" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="${{ secrets.SONAR_HOST_URL }}"
+          dotnet build
+          ${{ runner.temp }}\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
</code_context>
<issue_to_address>
**suggestion:** Using a bare `dotnet build` can be brittle if the repo layout changes.

The previous workflow built `SDL3\SharpSDL3.csproj` explicitly; now it relies on whatever the working directory treats as the default project/solution. If more projects/solutions are added at the repo root or that default changes, this step could build the wrong thing or fail. Please specify the intended project/solution in the `dotnet build` command to keep the workflow resilient to repo layout changes.

```suggestion
          dotnet build SDL3\SharpSDL3.csproj
```
</issue_to_address>

### Comment 2
<location path=".github/workflows/build.yml" line_range="40" />
<code_context>
         run: |
-          New-Item -Path .\.sonar\scanner -ItemType Directory
-          dotnet tool update dotnet-sonarscanner --tool-path .\.sonar\scanner
+          New-Item -Path ${{ runner.temp }}\scanner -ItemType Directory
+          dotnet tool update dotnet-sonarscanner --tool-path ${{ runner.temp }}\scanner
       - name: Build and analyze
</code_context>
<issue_to_address>
**issue:** Creating the scanner directory unconditionally may fail if the cache already restored it.

If `actions/cache` restores `${{ runner.temp }}\scanner`, the directory will already exist and `New-Item` (without `-Force`) will throw, breaking the job on cache hits. Please either check for existence before creating it or add `-Force` so this step is safe for both cached and non-cached runs.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.