[guillaume-dequenne]

Part of CLP-897

Summary

• Split the Maven build/deploy producer from the NEXT analysis consumer.
• Upload the exact Maven target outputs as a three-day artifact and restore them for the scan.
• Reuse the same build number and Maven scan configuration so the analysis remains equivalent.
• Keep promotion and releasability gated by the scan.

Dependency

• Scanner-only mode is provided by PREQ-8698 Add skip build option to maven build ci-github-actions#348 and is currently pinned to its reviewed commit. Re-pin to v1 or v2 once that PR is merged.

Validation

• Parsed the updated workflow as YAML.
• Ran actionlint, accounting for existing Sonar-specific workflow extensions.
• Ran git diff --check.

[hashicorp-vault-sonar-prod]

CLP-897

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Separates Maven build and scanning into artifact-backed workflow jobs.

Refactors the CI workflow to decouple the Maven build/deploy producer from the NEXT analysis consumer, uploading build outputs as a three-day artifact for reuse during analysis while maintaining build number and scan configuration equivalence. No issues found.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}