Execute SonarQube Analysis

Run a SonarQube analysis for a project and publish results to the configured SonarQube server. This skill supports two project families — Maven (Java) and Node/React (npm/yarn/pnpm) — and only executes the analysis; use the fix-sonar-issues skill to triage and remediate reported findings afterward.

Preferred Execution Path: scripts/execute-sonar.sh

This skill ships a single deterministic script, scripts/execute-sonar.sh, that performs project-type detection and tool resolution itself. Prefer invoking this script over manually assembling a command. It:

1. Detects the project type from the target directory: Maven (pom.xml present) or Node/React (package.json present).
2. For Maven, runs mvn verify sonar:sonar with the required flags.
3. For Node/React, resolves a scanner binary deterministically, in this order: a. A sonar-scanner CLI already on PATH (no download). b. A project-local node_modules/.bin/sonar-scanner devDependency binary (no download, version-pinned by the repo). c. Only as a last-resort fallback: npx --yes sonar-scanner, which may download the package on every run — the script prints a warning when this path is used.
4. Fails fast with a clear message if neither project type is detected, or if a required environment variable or tool is missing, instead of guessing.

Run it with the required environment variables already exported (never pass secrets as inline command-line literals from chat/task context):