add sourcecode analysis

[wolframhaussig]

I would like to suggest using SonarQube to keep code quality up. SonarQube is a code analyzer to point out bugs, potential security issues and code smells. SonarCloud is free to use for opensource projects and is easy to connect. I took the liberty to connect my pf4j fork to the SonarQ cloud: https://sonarcloud.io/dashboard?id=wolframhaussig_pf4j

Here is the PR for the change to support SonarQube: https://github.com/wolframhaussig/pf4j/pull/1/files . You can get started by going to the projects settings -> integrations -> SonarQube

[decebals]

It's a good idea.
I created #458.

[wolframhaussig]

Unfortunately, SonarQube will not run on foreign Pull requests (see details here) - sorry for that...

Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.0.2155:sonar (default-cli) on project pf4j: You're not authorized to run analysis. Please contact the project administrator.

So we either ignore the pipeline error on external Pull requests or we update the build.yml to only run when the token exists:

script: >-
  if [ "${SONAR_TOKEN}" != "" ]; then
    cd pf4j && mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
  else
    cd pf4j && mvn -B verify
  fi

Note: above code is untested