[guillaume-dequenne]

Part of CLP-897

Summary

• Split the Maven build/deploy producer from the NEXT analysis consumer.
• Upload the exact Maven target outputs as a three-day artifact and restore them for the scan.
• Reuse the same build number and Maven scan configuration so the analysis remains equivalent.
• Keep promotion and releasability gated by the scan.

Dependency

• Scanner-only mode is provided by PREQ-8698 Add skip build option to maven build ci-github-actions#348 and is currently pinned to its reviewed commit. Re-pin to v1 or v2 once that PR is merged.

Validation

• Parsed the updated workflow as YAML.
• Ran actionlint, accounting for existing Sonar-specific workflow extensions.
• Ran git diff --check.

[hashicorp-vault-sonar-prod]

CLP-897

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[github-actions]

Ruling Report

✅ No changes to ruling expected issues in this PR

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Separates Maven production and scanning, with promotion still gated by scan.

Splits Maven build/deploy producer from NEXT analysis consumer, uploading target outputs as a three-day artifact and restoring them for the scan while maintaining build number and configuration equivalence. Workflow parsing and linting validated. No issues found.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}