[guillaume-dequenne]

Part of CLP-897; tracked by CLP-988.

Split Maven build/test/deploy from NEXT analysis so a failed analysis can be rerun using the producer's seven-day build artifact. The producer explicitly enables coverage; the consumer restores the output and reuses the same build number with build-maven@v2 scanner-only mode, released in 2.3.0.

Analysis runs on PRs, the default branch, maintenance branches and long-lived feature branches, matching the shared action's scan policy. Promotion requires successful build/QA dependencies and successful analysis where it runs, while accepting an intentional analysis skip on other refs. Producer and consumer use the same toolchain setup.

Validation: rebased onto current master (October 9), with no merge commits, checked the workflow YAML and diff whitespace, and exercised branch and promotion conditions across PR, main, maintenance, long-lived feature, dogfood, merge-queue and dispatch scenarios, including failures, skipped analysis and cancellation. The rebased tree matches the previously verified tree exactly. Latest-commit CI passed: Build and SCA Check.

IRIS now waits for NEXT analysis, and failure notifications include the analysis job.

[hashicorp-vault-sonar-prod]

CLP-988

[github-actions]

Ruling Report

✅ No changes to ruling expected issues in this PR

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[mary-georgiou]

LGTM

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Splitting build and NEXT analysis changes CI promotion gates; condition or artifact-flow errors could block releases or promote builds without completed analysis.

Splits the Maven build from SonarHTML analysis by uploading build outputs as a seven-day artifact and restoring them in a separate analysis job, while reusing the same build number and scan configuration. IRIS no longer waits for the NEXT analysis it compares against, addressing that finding. No open issues remain.

✅ 1 closed

✅ Bug: IRIS no longer waits for the NEXT analysis it compares against

📄 .github/workflows/build.yml:60-74 📄 .github/workflows/build.yml:318-331
Before this PR, the NEXT analysis ran inside the build job. Because iris declares needs: [build, analyze-shadows], IRIS always started after the primary Next project had been analysed. This PR moves that analysis into the new analysis job, and iris was not updated to depend on it. In scheduled runs, analysis and analyze-shadows both start once build finishes and run in parallel. IRIS (primary_platform: Next, primary_project_key: org.sonarsource.html:html) can therefore start as soon as the shadows finish, while the NEXT analysis is still running. It would then compare the shadows against the previous run's Next data. It also still runs when the NEXT analysis fails. Fix: add analysis to the needs list of iris.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}