From 7225d061d1e49f57a4f30c8cb4ac7448e8df54e7 Mon Sep 17 00:00:00 2001
From: jamesthompson26-nhs <james.thompson26@nhs.net>
Date: Mon, 13 Jul 2026 16:46:07 +0100
Subject: [PATCH] CCM-18946: Sonar PR Decoration Fixes

---
 .github/workflows/cicd-1-pull-request.yaml | 10 +++++---
 scripts/reports/perform-static-analysis.sh | 29 +++++++++++++++++++---
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml
index c2dda30c..d25f476b 100644
--- a/.github/workflows/cicd-1-pull-request.yaml
+++ b/.github/workflows/cicd-1-pull-request.yaml
@@ -3,14 +3,18 @@ name: "1. CI/CD pull request"
 # The total recommended execution time for the "CI/CD Pull Request" workflow is around 20 minutes.
 
 on:
-  push:
+  push: ## Only trigger on pushes to main branch to prevent unnecessary runs on feature branches, as the pull_request trigger will handle PR events.
     branches:
-      - "**"
+      - main
   pull_request:
-    types: [opened, reopened]
+    types: [opened, reopened, synchronize]
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   metadata:
     name: "Set CI/CD metadata"
diff --git a/scripts/reports/perform-static-analysis.sh b/scripts/reports/perform-static-analysis.sh
index 9c62c19a..aca7a514 100755
--- a/scripts/reports/perform-static-analysis.sh
+++ b/scripts/reports/perform-static-analysis.sh
@@ -37,12 +37,15 @@ function main() {
 
 function run-sonar-scanner-natively() {
 
+  local -a context_args
+  context_args=($(build-sonar-context-args))
+
   sonar-scanner \
     -Dproject.settings="$PWD/scripts/config/sonar-scanner.properties" \
-    -Dsonar.branch.name="${BRANCH_NAME:-$(git rev-parse --abbrev-ref HEAD)}" \
     -Dsonar.organization="$SONAR_ORGANISATION_KEY" \
     -Dsonar.projectKey="$SONAR_PROJECT_KEY" \
-    -Dsonar.token="$SONAR_TOKEN"
+    -Dsonar.token="$SONAR_TOKEN" \
+    "${context_args[@]}"
 
   return 0
 }
@@ -52,22 +55,40 @@ function run-sonar-scanner-in-docker() {
   # shellcheck disable=SC1091
   source ./scripts/docker/docker.lib.sh
 
+  local -a context_args
+  context_args=($(build-sonar-context-args))
+
   # shellcheck disable=SC2155
   local image=$(name=sonarsource/sonar-scanner-cli docker-get-image-version-and-pull)
   docker run --rm --platform linux/amd64 \
     --volume "$PWD":/usr/src \
     "$image" \
       -Dproject.settings=/usr/src/scripts/config/sonar-scanner.properties \
-      -Dsonar.branch.name="${BRANCH_NAME:-$(git rev-parse --abbrev-ref HEAD)}" \
       -Dsonar.organization="$SONAR_ORGANISATION_KEY" \
       -Dsonar.projectKey="$SONAR_PROJECT_KEY" \
-      -Dsonar.token="$SONAR_TOKEN"
+      -Dsonar.token="$SONAR_TOKEN" \
+      "${context_args[@]}"
 
   return 0
 }
 
 # ==============================================================================
 
+function build-sonar-context-args() {
+
+  if [[ "${GITHUB_EVENT_NAME:-}" == "pull_request" ]]; then
+    local pr_number
+    pr_number=$(echo "${GITHUB_REF:-}" | grep -oP 'refs/pull/\K[0-9]+')
+    echo "-Dsonar.pullrequest.key=${pr_number}"
+    echo "-Dsonar.pullrequest.branch=${GITHUB_HEAD_REF:-${BRANCH_NAME}}"
+    echo "-Dsonar.pullrequest.base=${GITHUB_BASE_REF:-main}"
+  else
+    echo "-Dsonar.branch.name=${BRANCH_NAME:-$(git rev-parse --abbrev-ref HEAD)}"
+  fi
+}
+
+# ==============================================================================
+
 function is-arg-true() {
   local arg="$1"