[mary-georgiou]

Part of CLP-466

---

Summary by Gitar

• New Features:
  • Added skip-build input option to run Sonar analysis using existing target/ output without compiling, testing or deploying
• Validations & Tests:
  • Added checks ensuring skip-build requires deploy: false and validates restored target/classes output

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

PREQ-8698

[tomverin]

Looks good — the right shape for a scanner-only Maven consumer. The deploy: false guard, restore check, and existing Sonar orchestration are all in the right places.

Left a few non-blocking nits: harden check_build_output_restored (/usr/bin/find, drop maxdepth 4), fail or warn when skip-build would do nothing, assert the restore check is actually called from build_maven, and add a short producer/consumer example in the README.

Please rebase onto master before merge — the PR is currently behind.

[mary-georgiou]

@tomverin thanks a lot! I drafted this cause we paused the sprint we are working on. I'll test it more and merge it later (later = during next week).
I'll apply your comments and reask for review. IT's a big change so I would feel more comfortable if you'd look again.

[guillaume-dequenne]

Testing follow-up against the current PR commit 02c4736: sonar-lits #177 passed its separate Build and Scan jobs (run); the Scan job downloaded the build artifact and ran Sonar without compiling, testing or deploying. The coverage comparison also passed on this commit: #179 imported JaCoCo and reported 60% new-code coverage (run), while #180 omitted -Pcoverage, imported no report and reported 0% (run). All checks on these three PRs passed. This validates the normal artifact handoff and coverage transfer; it does not directly test rerunning only the Scan job.

[guillaume-dequenne]

@tomverin I know you approved this PR already, but would you mind having another look following the latest changes from 02c4736?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 4 closed / 4 findings

🟡 Medium risk · Adds a Maven scanner-only mode that skips compilation, tests, and deployment.

Adds skip-build input option to run Sonar analysis using existing target/ output without compiling, testing, or deploying. Resolved issues with silent no-ops on deploy and unanalyzed branches, missing README documentation, spec coverage gaps, and hard failures on merge_group and dogfood runs.

✅ 4 closed

✅ Edge Case: skip-build silently no-ops deploy and unanalyzed branches

📄 build-maven/build.sh:154 📄 build-maven/build.sh:192-198 📄 build-maven/build.sh:201 📄 build-maven/action.yml:19-25 📄 build-maven/action.yml:224-225 📄 build-maven/action.yml:247-248
With skip-build: true the script skips the whole build/deploy block unconditionally, so two combinations end in a silently green job with nothing done: (a) deploy left at its default true on master/maintenance/dogfood/long-lived branches — should_deploy is never consulted, deployed is never written to $GITHUB_OUTPUT, and the downstream Artifacts upload, Generate provenance attestation and deployment summary steps in action.yml all skip while the caller believes it deployed; (b) a branch where should_scan returns 1 (short-lived branch, or sonar-platform: none with shadow scans off) — the build is skipped and no scan runs, so build.sh exits 0 having performed no work at all. Guard the combination explicitly: warn (or fail) when SKIP_BUILD=true and should_deploy, and warn when SKIP_BUILD=true and should_scan is false, so a misconfigured scanner-only job is visible instead of a green no-op.

✅ Quality: New skip-build input missing from README inputs table

📄 build-maven/action.yml:19-25
The build-maven inputs table in README.md documents every other input of the action (deploy, deploy-pull-request, maven-args, provenance, ...) but the newly added skip-build is absent, so the only place it is described is action.yml. Add a row to the table (and ideally a short subsection explaining the scanner-only job pattern with deploy: false) to keep the documented input list complete.

✅ Quality: No spec coverage for the SKIP_BUILD branch

📄 build-maven/build.sh:154-168
spec/build-maven_spec.sh asserts the exact stdout line sequence for every existing branch case, but no example sets SKIP_BUILD=true, so the new branch in build_maven (no mvn deploy/install, no deployed output, scan still executed) is entirely untested and a regression that re-enables the build or drops the scan would pass CI. Add examples covering SKIP_BUILD=true on an analyzed branch (expects the skip message plus orchestrate_sonar_platforms, and no mvn deploy/mvn install) and on the default branch with DEPLOY=true (asserting no deployed=true output).

✅ Edge Case: skip-build scan job now hard-fails on merge_group and dogfood runs

📄 build-maven/build.sh:213-222 📄 README.md:379-393
This commit changed build_maven so that SKIP_BUILD=true returns 1 when should_scan is false. should_scan only passes on the default branch, branch-*, PRs and feature/long/*. The README's own workflow templates trigger on merge_group and workflow_dispatch. A merge-queue run has GITHUB_REF_NAME=gh-readonly-queue/..., and a dogfood push has dogfood-on-*, which is deployed but not scanned. For both, should_scan is false.

If someone copies the new README example (a scan job with skip-build: true and no branch/event condition) into one of those workflows, every merge-queue run and dogfood push fails with "Nothing to do". If the scan job is a required check, merges get blocked.

Fix: either document that the scan job needs a condition that matches should_scan, or make this case skip with a notice instead of failing on events that are never analyzed, such as merge queue.

Verification Repos 6 inspected

Functional validation No results

Rules No rules evaluated

Cross-repo 6 repositories inspected 0 open impacts

SonarSource/sonar-analyzer-commons Inspected
SonarSource/sonar-update-center Inspected
SonarSource/reddeer Inspected
SonarSource/nodejs-maven-plugin Inspected
SonarSource/orchestrator Inspected

1 more repository

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}