Activate SonarQube Cloud after security baseline review #63

Outcome

Activate the repository's existing disabled-by-default SonarQube Cloud workflow only after the organization/project and initial quality profile have been reviewed.

Current state

• .github/workflows/sonarqube.yml is committed and validated by GitHub.
• .config/dotnet-tools.json pins the .NET scanner.
• docs/sonarqube.md documents the threat model and activation sequence.
• Repository variable SONAR_ENABLED is explicitly false.
• No Sonar token or organization/project identifiers are stored in the repository.

Activation checklist

• Import ATAC-Helicopter/Blueprints into SonarQube Cloud using the intended organization account.
• Review the default quality profile and quality gate before granting repository access.
• Add SONAR_TOKEN as a repository Actions secret.
• Add SONAR_ORGANIZATION and SONAR_PROJECT_KEY as repository variables.
• Set SONAR_ENABLED to true.
• Run the workflow manually and review every initial finding; do not bulk-dismiss findings.
• Confirm pull requests from forks cannot read the token.
• After a stable baseline, add SonarQube analysis to required checks on develop and main.
• Record the activation and baseline policy in the changelog/security documentation.

Security note

This issue contains no credentials. Tokens must remain in GitHub Actions secrets and must never be copied into source, workflow YAML, issue comments, or logs.