From cbbc698d197ba92b4cda33fec72393342ea63d66 Mon Sep 17 00:00:00 2001
From: jamesthompson26-nhs <james.thompson26@nhs.net>
Date: Tue, 14 Jul 2026 11:33:08 +0100
Subject: [PATCH] CCM-18946: Sonar PR Decoration Fixes

---
 .github/workflows/cicd-1-pull-request.yaml |  8 +++--
 scripts/reports/perform-static-analysis.sh | 38 +++++++++++++++++++---
 2 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml
index c96c8d85..9daf635e 100644
--- a/.github/workflows/cicd-1-pull-request.yaml
+++ b/.github/workflows/cicd-1-pull-request.yaml
@@ -5,12 +5,16 @@ name: "1. CI/CD pull request"
 on:
   push:
     branches:
-      - "**"
+      - "main"
   pull_request:
-    types: [opened, reopened]
+    types: [opened, reopened, synchronize]
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 permissions:
   id-token: write
   contents: write
diff --git a/scripts/reports/perform-static-analysis.sh b/scripts/reports/perform-static-analysis.sh
index 2426e6d0..aca7a514 100755
--- a/scripts/reports/perform-static-analysis.sh
+++ b/scripts/reports/perform-static-analysis.sh
@@ -31,16 +31,23 @@ function main() {
   else
     run-sonar-scanner-in-docker
   fi
+
+  return 0
 }
 
 function run-sonar-scanner-natively() {
 
+  local -a context_args
+  context_args=($(build-sonar-context-args))
+
   sonar-scanner \
     -Dproject.settings="$PWD/scripts/config/sonar-scanner.properties" \
-    -Dsonar.branch.name="${BRANCH_NAME:-$(git rev-parse --abbrev-ref HEAD)}" \
     -Dsonar.organization="$SONAR_ORGANISATION_KEY" \
     -Dsonar.projectKey="$SONAR_PROJECT_KEY" \
-    -Dsonar.token="$SONAR_TOKEN"
+    -Dsonar.token="$SONAR_TOKEN" \
+    "${context_args[@]}"
+
+  return 0
 }
 
 function run-sonar-scanner-in-docker() {
@@ -48,23 +55,44 @@ function run-sonar-scanner-in-docker() {
   # shellcheck disable=SC1091
   source ./scripts/docker/docker.lib.sh
 
+  local -a context_args
+  context_args=($(build-sonar-context-args))
+
   # shellcheck disable=SC2155
   local image=$(name=sonarsource/sonar-scanner-cli docker-get-image-version-and-pull)
   docker run --rm --platform linux/amd64 \
     --volume "$PWD":/usr/src \
     "$image" \
       -Dproject.settings=/usr/src/scripts/config/sonar-scanner.properties \
-      -Dsonar.branch.name="${BRANCH_NAME:-$(git rev-parse --abbrev-ref HEAD)}" \
       -Dsonar.organization="$SONAR_ORGANISATION_KEY" \
       -Dsonar.projectKey="$SONAR_PROJECT_KEY" \
-      -Dsonar.token="$SONAR_TOKEN"
+      -Dsonar.token="$SONAR_TOKEN" \
+      "${context_args[@]}"
+
+  return 0
+}
+
+# ==============================================================================
+
+function build-sonar-context-args() {
+
+  if [[ "${GITHUB_EVENT_NAME:-}" == "pull_request" ]]; then
+    local pr_number
+    pr_number=$(echo "${GITHUB_REF:-}" | grep -oP 'refs/pull/\K[0-9]+')
+    echo "-Dsonar.pullrequest.key=${pr_number}"
+    echo "-Dsonar.pullrequest.branch=${GITHUB_HEAD_REF:-${BRANCH_NAME}}"
+    echo "-Dsonar.pullrequest.base=${GITHUB_BASE_REF:-main}"
+  else
+    echo "-Dsonar.branch.name=${BRANCH_NAME:-$(git rev-parse --abbrev-ref HEAD)}"
+  fi
 }
 
 # ==============================================================================
 
 function is-arg-true() {
+  local arg="$1"
 
-  if [[ "$1" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
+  if [[ "$arg" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
     return 0
   else
     return 1