GitHub Actions workflow scan shows 185k lines but 0.0% duplication in SonarQube

Rules and Languages New rules / language support
1

Hello Sonar Community,

I am working on an enterprise-level GitHub Actions workflow scan in SonarQube.

My use case is not to scan application source code. I want to scan only GitHub Actions pipeline/workflow files from multiple repositories and treat them as one single SonarQube project.

Setup

We have around:

  • 60 GitHub organizations

  • 300+ repositories

  • More than 2000 GitHub Actions workflow files

In our GitHub Actions pipeline, we collect all workflow files from different repositories into one workspace while preserving the .github/workflows path.

Example collected structure:

pipeline-scan-workspace/
  org-a/
    repo-a/
      .github/
        workflows/
          build.yml
          deploy.yml

  org-b/
    repo-b/
      .github/
        workflows/
          ci.yml

Then we run one SonarQube scan as a single project.

Scanner command

sonar-scanner \
  -Dsonar.projectKey="enterprise-github-actions-pipeline-scan" \
  -Dsonar.projectName="Enterprise GitHub Actions Pipeline Scan" \
  -Dsonar.projectVersion="${GITHUB_REF_NAME}-${GITHUB_RUN_NUMBER}-${GITHUB_RUN_ATTEMPT}" \
  -Dsonar.sources="pipeline-scan-workspace" \
  -Dsonar.inclusions="**/.github/workflows/**/*.yml,**/.github/workflows/**/*.yaml,**/actions.yml,**/actions.yaml" \
  -Dsonar.githubactions.activate=true \
  -Dsonar.qualitygate.wait=true

Observation

The scan is successful and SonarQube shows around:

Lines: 185k
Duplications: 0.0%
Duplicated lines: 0
Duplicated blocks: 0
Duplicated files: 0

This is surprising because many repositories have similar or repeated GitHub Actions workflow steps/jobs. I expected some duplication to be detected.

Questions

  1. Does SonarQube support duplication detection for GitHub Actions workflow files / YAML files?

  2. If yes, what is the exact condition for duplication detection in GitHub Actions workflow files?

  3. Does duplication detection work for files detected as GitHub Actions, or only for normal programming languages?

  4. Is 0.0% duplication expected for YAML/GitHub Actions workflows even when many workflow blocks are repeated?

  5. Is there any scanner property required to enable duplication detection for GitHub Actions or YAML?

  6. Is our approach correct where we collect workflows into one workspace and preserve the path as org/repo/.github/workflows/*.yml?

  7. Could sonar.sources="pipeline-scan-workspace" affect GitHub Actions detection or duplication detection?

Expected behavior

I expected SonarQube to identify duplicated workflow blocks across multiple workflow files or repositories, because all workflows are scanned as one single project.

Actual behavior

SonarQube counts the lines correctly, but duplication remains 0.0%.

Could you please confirm whether duplication detection is supported for GitHub Actions/YAML workflow files, and if there is any recommended configuration for this use case?

Thanks.