I checked this rough and didn't understand why there are some things we do not have in ASB for example. GITHUB_TOKEN are not used in the ASB test.yml ... can you elaborate on this one?

In other projects like ASB we use SonarCloud's automatic analysis [1]. So Sonar is just informed that changes have been pushed and performs static code analysis. This is fine for many quality checks, but has at least one flaw: No other build stages are executed, so the analyzer has no idea about test coverage.

In AntiVirus we used to have test coverage analysis as well, so I switched from automatic to CI-based analysis. This usese an additional "SonarCloud Scan" stage as part of the CI pipeline where the analysis is actively performed and the results pushed to SonarCloud.

This PR is not a good example to show this in action. Because no code was changed, we obviously have no coverage on "new code"... The analysis overview[3] estimates 32.8% after merge which is roughly the same as CodeCov calculated before.

[1] https://docs.sonarcloud.io/advanced-setup/automatic-analysis/
[2] https://docs.sonarcloud.io/advanced-setup/ci-based-analysis/github-actions-for-sonarcloud/
[3] https://sonarcloud.io/summary/new_code?id=pluginkollektiv_antivirus&pullRequest=129

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information