NPA-7116: Add Sonar cloud scanning for sandbox only

[ellie-bound1-NHSD]

Pull Request

🧾 Ticket Link

https://nhsd-jira.digital.nhs.uk/browse/NPA-7116

---

📄 Description/Summary of Changes

• Add SonarQ Cloud Scanning to Sandbox directory

---

🧪 Developer Testing Carried Out

• Can see in commit checks a sonar cloud scan is added as part of the PR checks. Analysis is passing -> https://sonarcloud.io/summary/new_code?id=NHSDigital_validated-relationships-service-api&pullRequest=386

---

📋 PR Principles

• Keep PRs Small and Focused: Ensure the PR addresses a single task or feature to make it easier to review.
• Multiple PRs for one Ticket: When splitting work into multiple PRs, clearly describe what this PR addresses and outline the remaining work to complete the ticket.
• Ensure Tests Are Included: Add or update unit, integration, or end-to-end tests to cover the changes made.
• Follow Coding Standards: Ensure the code adheres to the team's coding guidelines and best practices.
• Resolve Comments Promptly: If you raise a comment, ensure you follow up and resolve it before approving the PR to maintain clarity and ensure comments are addressed.
• Foster Learning: PR reviews are an opportunity to share knowledge, provide constructive feedback, and encourage a collaborative environment.

🏷️ Naming Conventions Reminder

Please ensure the following naming conventions are followed:

• PR title follows the format: NPA-XXXX: <short-description>
• Branch name follows the convention: <type>/NPA-XXXX/<short-description>
• Commit messages follow the template: NPA-XXXX: <short-description>

[Copilot]

Pull request overview

Adds SonarQ Cloud static analysis configuration to this repository, targeting the sandbox directory so Sonar analysis focuses on the sandboxed API code.

Changes:

• Introduces sonar-project.properties to configure Sonar project/org and restrict analysis scope to sandbox.
• Adds a GitHub Actions workflow to run SonarCloud analysis on pushes and pull requests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
sonar-project.properties	Adds Sonar project configuration and limits sources to sandbox.
.github/workflows/sonarcloud.yml	Adds a CI workflow to run the Sonar scanner in GitHub Actions.

Suppressed comments (1)

.github/workflows/sonarcloud.yml:15

• actions/checkout is referenced by tag (@v4) while other workflows in this repo pin actions to a full commit SHA (e.g. actions/checkout@d23441... # v6). Pinning helps prevent supply-chain issues from a retagged or compromised release.

      - uses: actions/checkout@v4

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[davesmallnhs]

LGTM