From 77a5c67b71bc2a1035935e1725fa775904bd7402 Mon Sep 17 00:00:00 2001
From: Lars Hampe <hello@hashdot.co>
Date: Fri, 20 Mar 2026 23:54:33 +0100
Subject: [PATCH] feat: add version inputs for sonarqube and dependency track

---
 .github/workflows/sonarqube.yaml | 10 +++++++++-
 .github/workflows/trivy_fs.yaml  |  6 ++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sonarqube.yaml b/.github/workflows/sonarqube.yaml
index 1453987..451be31 100644
--- a/.github/workflows/sonarqube.yaml
+++ b/.github/workflows/sonarqube.yaml
@@ -1,5 +1,10 @@
 on:
   workflow_call:
+    inputs:
+      version:
+        required: false
+        type: string
+        default: ''
     secrets:
       SONARQUBE_HOST:
         required: true
@@ -22,4 +27,7 @@ jobs:
       uses: sonarsource/sonarqube-scan-action@master
       env:
         SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST }}
-        SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
\ No newline at end of file
+        SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
+      with:
+        args: >
+          -Dsonar.projectVersion=${{ inputs.version }}
\ No newline at end of file
diff --git a/.github/workflows/trivy_fs.yaml b/.github/workflows/trivy_fs.yaml
index a3674fd..4b35a9a 100644
--- a/.github/workflows/trivy_fs.yaml
+++ b/.github/workflows/trivy_fs.yaml
@@ -1,5 +1,10 @@
 on:
   workflow_call:
+    inputs:
+      version:
+        required: false
+        type: string
+        default: ''
     secrets:
       DEPENDENCYTRACK_URL:
         required: true
@@ -41,6 +46,7 @@ jobs:
             -H "X-Api-Key: ${{ secrets.DEPENDENCYTRACK_API_KEY }}" \
             -H "Content-Type: multipart/form-data" \
             -F "project=${{ secrets.DEPENDENCYTRACK_PROJECT_UUID }}" \
+            -F "projectVersion=${{ inputs.version }}" \
             -F "bom=@sbom.json")
  
           echo "Response: $(cat /tmp/dt-response.json)"