From 23c24be394ac4937ae89c91a6786fec7e3041089 Mon Sep 17 00:00:00 2001
From: "cristian.henao" <cristian.henao@onoff.com.co>
Date: Thu, 29 Jan 2026 08:59:11 -0500
Subject: [PATCH 1/2] ci: add bootstrap workflow (tests + sonar)

---
 .github/workflows/qualityrisk_bootstrap.yaml | 46 ++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/qualityrisk_bootstrap.yaml

diff --git a/.github/workflows/qualityrisk_bootstrap.yaml b/.github/workflows/qualityrisk_bootstrap.yaml
new file mode 100644
index 000000000..c1da228b6
--- /dev/null
+++ b/.github/workflows/qualityrisk_bootstrap.yaml
@@ -0,0 +1,46 @@
+name: QualityRisk Bootstrap (Tests + Sonar)
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  qualityrisk:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout (full history for PR diff + sonar)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install deps
+        run: |
+          python -m pip install -U pip
+          pip install -e .
+          pip install pytest
+
+      - name: Run tests
+        run: pytest -q
+
+      - name: SonarQube Cloud scan (SonarCloud)
+        uses: SonarSource/sonarqube-scan-action@v7
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.projectKey=${{ secrets.SONAR_PROJECT_KEY }}
+            -Dsonar.organization=${{ secrets.SONAR_ORG }}
+            -Dsonar.sources=click
+            -Dsonar.tests=tests
+            -Dsonar.python.version=3.11
+            -Dsonar.exclusions=**/docs/**,**/build/**,**/dist/**,**/.venv/**,**/.tox/**

From fb37c025c463f7b974805a0ec3f10a24ef688dba Mon Sep 17 00:00:00 2001
From: "cristian.henao" <cristian.henao@onoff.com.co>
Date: Thu, 29 Jan 2026 09:16:29 -0500
Subject: [PATCH 2/2] ci: fix sonar sources path

---
 .github/workflows/qualityrisk_bootstrap.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/qualityrisk_bootstrap.yaml b/.github/workflows/qualityrisk_bootstrap.yaml
index c1da228b6..497933a65 100644
--- a/.github/workflows/qualityrisk_bootstrap.yaml
+++ b/.github/workflows/qualityrisk_bootstrap.yaml
@@ -40,7 +40,7 @@ jobs:
           args: >
             -Dsonar.projectKey=${{ secrets.SONAR_PROJECT_KEY }}
             -Dsonar.organization=${{ secrets.SONAR_ORG }}
-            -Dsonar.sources=click
+            -Dsonar.inclusions=src/**/*.py
             -Dsonar.tests=tests
             -Dsonar.python.version=3.11
             -Dsonar.exclusions=**/docs/**,**/build/**,**/dist/**,**/.venv/**,**/.tox/**