[guillaume-dequenne]

Part of CLP-897

Summary

• Split the Maven build/deploy producer from the NEXT analysis consumer.
• Upload the exact Maven target outputs as a three-day artifact and restore them for the scan.
• Reuse the same build number and Maven scan configuration so the analysis remains equivalent.
• Keep promotion and releasability gated by the scan.

Dependency

• Scanner-only mode is provided by PREQ-8698 Add skip build option to maven build ci-github-actions#348 and is currently pinned to its reviewed commit. Re-pin to v1 or v2 once that PR is merged.

Validation

• Parsed the updated workflow as YAML.
• Ran actionlint, accounting for existing Sonar-specific workflow extensions.
• Ran git diff --check.

[hashicorp-vault-sonar-prod]

CLP-897

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Build | Build — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3b91f6b | Docs | View more details | Give us feedback!}

[gitar-bot]

⚠️ Bug: Scan artifact leaves out coverage/java/jacoco.xml, so NEXT loses coverage

The build job only uploads **/target. The aggregate JaCoCo report is written somewhere else: coverage-report/pom.xml sets report-aggregate to write to ${maven.multiModuleProjectDirectory}/coverage/java, and the root pom.xml points sonar.coverage.jacoco.xmlReportPaths at ${maven.multiModuleProjectDirectory}/coverage/java/jacoco.xml. That file never goes into the artifact, and a fresh checkout doesn't have it. The skip-build scan will therefore run without a coverage report and send 0%/missing coverage to NEXT. That contradicts the PR's claim that the analysis stays equivalent, and it can fail the coverage condition of the quality gate. To fix it, add coverage/java to the uploaded paths (the upload root is still the workspace, so the download restores it to the same place). You could also add if-no-files-found: error so a missing report is caught.

Include the aggregate coverage report in the scan artifact:

- name: Upload build output for scanning
  uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
  with:
    name: build-output-${{ steps.build.outputs.BUILD_NUMBER }}
    path: |
      **/target
      coverage/java
    if-no-files-found: error
    retention-days: 3

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

CI failed: Maven build failed on the coverage-report project because the maven-enforcer-plugin detected a missing explicit version for the jacoco-maven-plugin.

Overview

1 build failure found across 1 job, caused by a strict Maven enforcer rule regarding plugin versions. The relationship to the PR is unclear/unrelated.

Failures

Maven Enforcer Plugin Version Failure (confidence: high)

• Type: build
• Affected jobs: 107123075655
• Related to change: no
• Root cause: Rule 8 of the maven-enforcer-plugin (RequirePluginVersions) failed because org.jacoco:jacoco-maven-plugin is missing an explicit version definition in the coverage-report project.
• Suggested fix: Add an explicit version for the org.jacoco:jacoco-maven-plugin in the relevant pom.xml to comply with build reproducibility rules.

Summary

• Change-related failures: 0
• Infrastructure/flaky failures: 0
• Recommended action: Update the coverage-report project's pom.xml to explicitly specify the jacoco-maven-plugin version.

Code Review ⚠️ Changes requested 0 closed / 1 findings

🟡 Medium risk · Separates Maven build from NEXT scanning and gates promotion on scan completion.

Splits Maven build from NEXT analysis using artifact caching to keep the analysis equivalent, but the scan artifact omits coverage/java/jacoco.xml, causing the skip-build scan to lose coverage data and potentially fail the quality gate. Add coverage/java to the uploaded paths to preserve the JaCoCo report.

⚠️ Bug: Scan artifact leaves out coverage/java/jacoco.xml, so NEXT loses coverage

📄 .github/workflows/build.yml:49-54 📄 .github/workflows/build.yml:83-85

The build job only uploads **/target. The aggregate JaCoCo report is written somewhere else: coverage-report/pom.xml sets report-aggregate to write to ${maven.multiModuleProjectDirectory}/coverage/java, and the root pom.xml points sonar.coverage.jacoco.xmlReportPaths at ${maven.multiModuleProjectDirectory}/coverage/java/jacoco.xml. That file never goes into the artifact, and a fresh checkout doesn't have it. The skip-build scan will therefore run without a coverage report and send 0%/missing coverage to NEXT. That contradicts the PR's claim that the analysis stays equivalent, and it can fail the coverage condition of the quality gate. To fix it, add coverage/java to the uploaded paths (the upload root is still the workspace, so the download restores it to the same place). You could also add if-no-files-found: error so a missing report is caught.

Include the aggregate coverage report in the scan artifact

- name: Upload build output for scanning
  uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
  with:
    name: build-output-${{ steps.build.outputs.BUILD_NUMBER }}
    path: |
      **/target
      coverage/java
    if-no-files-found: error
    retention-days: 3

🤖 Prompt for agents

Code Review: Splits Maven build from NEXT analysis using artifact caching to keep the analysis equivalent, but the scan artifact omits `coverage/java/jacoco.xml`, causing the skip-build scan to lose coverage data and potentially fail the quality gate. Add `coverage/java` to the uploaded paths to preserve the JaCoCo report.

1. ⚠️ Bug: Scan artifact leaves out coverage/java/jacoco.xml, so NEXT loses coverage
   Files: .github/workflows/build.yml:49-54, .github/workflows/build.yml:83-85

   The build job only uploads `**/target`. The aggregate JaCoCo report is written somewhere else: `coverage-report/pom.xml` sets `report-aggregate` to write to `${maven.multiModuleProjectDirectory}/coverage/java`, and the root `pom.xml` points `sonar.coverage.jacoco.xmlReportPaths` at `${maven.multiModuleProjectDirectory}/coverage/java/jacoco.xml`. That file never goes into the artifact, and a fresh checkout doesn't have it. The skip-build scan will therefore run without a coverage report and send 0%/missing coverage to NEXT. That contradicts the PR's claim that the analysis stays equivalent, and it can fail the coverage condition of the quality gate. To fix it, add `coverage/java` to the uploaded paths (the upload root is still the workspace, so the download restores it to the same place). You could also add `if-no-files-found: error` so a missing report is caught.

   Fix (Include the aggregate coverage report in the scan artifact):
   - name: Upload build output for scanning
     uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
     with:
       name: build-output-${{ steps.build.outputs.BUILD_NUMBER }}
       path: |
         **/target
         coverage/java
       if-no-files-found: error
       retention-days: 3

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact	Unblock
gitar auto-apply:on	gitar display:verbose	gitar unblock

_{Was this helpful? React with 👍 / 👎 | Gitar}