[aurelien-poscia-sonarsource]

Stacked on #363.

Why

sonarqube-auth-action now selects the SonarQube Cloud instance with sonar-region and no longer provides a host URL. The previous commit of #363 restored the two SonarQube Cloud URLs by reading them from Vault again, only so the scripts could pass -Dsonar.host.url. The scanners already derive the host from the region, so those Vault reads are redundant.

What

• build-*/action.yml: stop reading development/kv/data/sonarcloud url and development/kv/data/sonarqube-us url, and stop setting SQC_EU_URL and SQC_US_URL.
• shared/common-functions.sh: for sqc-eu and sqc-us, unset SONAR_HOST_URL. require_sonar_env only requires the token of these platforms. sqc-us still sets SONAR_REGION=us.
• build-*/build.sh: pass -Dsonar.host.url only when SONAR_HOST_URL is set (next), and pass -Dsonar.region explicitly when SONAR_REGION is set. Maven, Gradle and poetry did not pass the region property before. The Gradle "run sonar" guard now checks SONAR_TOKEN only.
• README: restore "instead of with Vault secrets" and document the scanner version requirement.
• Specs updated, with new cases for a region-only run.

How it was checked

• shellspec: the full suite passes, except update-release-channel (check-jsonschema not installed locally). check-sca failed once on a timing test and passed when rerun.
• shellcheck, yamllint and markdownlint pass.
• Scanner behavior read from the sources: @sonar/scan 4.3.0 and 5.0.2, and pysonar, default a blank host to https://sonarcloud.io, and sonar.region=us selects https://sonarqube.us.

Risks

• Region support starts with SonarScanner for Gradle 6.1 (the https://sonarcloud.io default starts with 6.0). The Maven plugin is pinned by build-maven (5.6.0.6792). A consumer on an older Gradle plugin fails on sqc-eu (falls back to localhost:9000) or sqc-us (region ignored). A sonar.host.url in the consumer's build that does not match the region makes the scanner library fail on sqc-us.
• Gradle region handling is only checked against the docs. The sonar-dummy pilot PRs (for example sonar-dummy-gradle-oss, build-windows on sqc-us) are the proof.
• check-sca still reads both URLs from Vault, since it has its own scan.

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SC-60373

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Removing Vault-provided cloud URLs makes scans depend on scanner region support, so older Gradle plugins may fail or use an unintended endpoint.

Stops reading SonarQube Cloud host URLs from Vault and lets the scanners resolve the host from sonar-region, passing -Dsonar.region explicitly in the build scripts. The README gave too-low scanner versions for the sqc-us region, which has been corrected. No open issues found.

✅ 1 closed

✅ Quality: README gives too-low scanner versions for sqc-us region

📄 README.md:109-111 📄 build-gradle/build.sh:128-133
The new README requirement says SonarScanner for Maven 5.0+ or SonarScanner for Gradle 6.0+ is enough, because the actions now pass sonar.region=us instead of sonar.host.url for sqc-us. Those versions only changed the default host to https://sonarcloud.io. Support for sonar.region arrived in Gradle 6.1 and Maven 5.1 (region requirements, Maven 5.1.0.4751 release).

The failure case: a Gradle project on plugin 6.0.x that follows this README and runs sqc-us (or run-shadow-scans). The scanner ignores -Dsonar.region=us and falls back to https://sonarcloud.io, then tries to upload with the US token, so the analysis fails. Before this PR it worked, because the host URL was passed explicitly. The same applies when a Maven user overrides SCANNER_VERSION to 5.0.x.

Fix: state the region-dependent minimums in the README (Maven 5.1+, Gradle 6.1+ for sqc-us; Maven 5.0+, Gradle 6.0+ for sqc-eu).

Verification Rules 2/2 met

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud