You need to integrate SonarQube into your CI/CD pipeline to provide PR decoration (inline comments on pull requests) and branch analysis. How do you set this up for GitHub with branch-aware analysis?

# GitHub Actions workflow for SonarQube PR decoration
# .github/workflows/sonarqube.yml
name: SonarQube Analysis
on:
  push:
    branches: [main, develop]
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full clone for accurate blame/history

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Build and Test with Coverage
        run: ./gradlew build jacocoTestReport

      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@v2
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        with:
          args: >
            -Dsonar.projectKey=order-service
            -Dsonar.sources=src/main/java
            -Dsonar.tests=src/test/java
            -Dsonar.java.binaries=build/classes
            -Dsonar.coverage.jacoco.xmlReportPaths=build/reports/jacoco/test/jacocoTestReport.xml

      - name: SonarQube Quality Gate
        uses: sonarsource/sonarqube-quality-gate-action@v1
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

# sonar-project.properties
sonar.projectKey=order-service
sonar.projectName=Order Service
sonar.sources=src/main/java
sonar.tests=src/test/java
sonar.java.binaries=build/classes/java/main
sonar.coverage.jacoco.xmlReportPaths=build/reports/jacoco/test/jacocoTestReport.xml
sonar.qualitygate.wait=true

# SonarQube server configuration for GitHub integration
# Administration > Configuration > General > ALM Integrations > GitHub
# - GitHub API URL: https://api.github.com
# - GitHub App ID: 12345
# - Client ID: Iv1.abc123
# - Client Secret: (from GitHub App)
# - Private Key: (PEM from GitHub App)
# - Webhook Secret: (configured in GitHub App)

# Jenkins pipeline with branch-aware analysis
pipeline {
  agent any
  stages {
    stage('Analysis') {
      steps {
        withSonarQubeEnv('sonar-prod') {
          script {
            def scannerParams = "-Dsonar.projectKey=order-service"
            if (env.CHANGE_ID) {
              // PR build
              scannerParams += " -Dsonar.pullrequest.key=${env.CHANGE_ID}"
              scannerParams += " -Dsonar.pullrequest.branch=${env.CHANGE_BRANCH}"
              scannerParams += " -Dsonar.pullrequest.base=${env.CHANGE_TARGET}"
            } else {
              // Branch build
              scannerParams += " -Dsonar.branch.name=${env.BRANCH_NAME}"
            }
            sh "sonar-scanner ${scannerParams}"
          }
        }
      }
    }
    stage('Quality Gate') {
      steps {
        timeout(time: 5, unit: 'MINUTES') {
          waitForQualityGate abortPipeline: true
        }
      }
    }
  }
}