From 82f4188a9c9a92dd1bf40c2f89b80f2671c9e252 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Wed, 23 Sep 2026 09:45:53 +0200 Subject: [PATCH 1/8] CLP-897 Split build from analysis --- .github/workflows/build.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5890ba2..cc74999 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -35,11 +35,44 @@ jobs: deploy-pull-request: true artifactory-reader-role: private-reader # Override default public-reader artifactory-deployer-role: qa-deployer # Override default public-deployer + sonar-platform: none + - name: Upload build output for scanning + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: build-output-${{ steps.build-step.outputs.BUILD_NUMBER }} + path: '**/target' + retention-days: 3 + + scan: + name: Scan + needs: build + runs-on: github-ubuntu-latest-s + permissions: + id-token: write + contents: read + env: + BUILD_NUMBER: ${{ needs.build.outputs.build-number }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + with: + version: 2026.9.11 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: build-output-${{ needs.build.outputs.build-number }} + - uses: SonarSource/ci-github-actions/build-maven@66c890622c26a71ea49efeb7e269bd58be455e77 # PR 348; re-pin to @v1 once merged + with: + deploy: false + skip-build: true + sonar-platform: next + artifactory-reader-role: private-reader + artifactory-deployer-role: qa-deployer promote: name: Promote needs: - build + - scan if: ${{ needs.build.outputs.deployed }} runs-on: github-ubuntu-latest-s # Public repo - use custom GitHub-hosted runner permissions: From 7ff6f3bc72983f9e0b2be945d89550d74d0d331d Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Wed, 23 Sep 2026 16:04:20 +0200 Subject: [PATCH 2/8] CLP-897 Preserve coverage in the build job --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index cc74999..3ca1b83 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -36,6 +36,7 @@ jobs: artifactory-reader-role: private-reader # Override default public-reader artifactory-deployer-role: qa-deployer # Override default public-deployer sonar-platform: none + maven-args: -Pcoverage - name: Upload build output for scanning uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: From 78bd9d72482de9951dadb5850c08676a50f0d50a Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Wed, 23 Sep 2026 16:04:30 +0200 Subject: [PATCH 3/8] CLP-897 Allow rerunning the build artifact upload --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3ca1b83..6b62972 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -43,6 +43,7 @@ jobs: name: build-output-${{ steps.build-step.outputs.BUILD_NUMBER }} path: '**/target' retention-days: 3 + overwrite: true scan: name: Scan From 6597926ff6211456885b84f306386ddbd2e90a7f Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Thu, 1 Oct 2026 14:51:47 +0200 Subject: [PATCH 4/8] Fix after review --- .github/workflows/build.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6b62972..fa97ed3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -37,16 +37,16 @@ jobs: artifactory-deployer-role: qa-deployer # Override default public-deployer sonar-platform: none maven-args: -Pcoverage - - name: Upload build output for scanning + - name: Upload Maven build as pipeline artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: build-output-${{ steps.build-step.outputs.BUILD_NUMBER }} path: '**/target' - retention-days: 3 + retention-days: 7 overwrite: true - scan: - name: Scan + analysis: + name: NEXT analysis needs: build runs-on: github-ubuntu-latest-s permissions: @@ -62,19 +62,18 @@ jobs: - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build-output-${{ needs.build.outputs.build-number }} - - uses: SonarSource/ci-github-actions/build-maven@66c890622c26a71ea49efeb7e269bd58be455e77 # PR 348; re-pin to @v1 once merged + - uses: SonarSource/ci-github-actions/build-maven@66c890622c26a71ea49efeb7e269bd58be455e77 # PR 348; re-pin after skip-build ships in @v2 with: deploy: false skip-build: true sonar-platform: next artifactory-reader-role: private-reader - artifactory-deployer-role: qa-deployer promote: name: Promote needs: - build - - scan + - analysis if: ${{ needs.build.outputs.deployed }} runs-on: github-ubuntu-latest-s # Public repo - use custom GitHub-hosted runner permissions: From d2a87b670f1a7b74d74d4d47e721c8ba0b325676 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Mon, 5 Oct 2026 14:30:26 +0200 Subject: [PATCH 5/8] CLP-994 Use released v2 scanner action --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index fa97ed3..9872b53 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -62,7 +62,7 @@ jobs: - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build-output-${{ needs.build.outputs.build-number }} - - uses: SonarSource/ci-github-actions/build-maven@66c890622c26a71ea49efeb7e269bd58be455e77 # PR 348; re-pin after skip-build ships in @v2 + - uses: SonarSource/ci-github-actions/build-maven@v2 with: deploy: false skip-build: true From 6627c688d97b00be37cbac87250f034925230752 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Fri, 9 Oct 2026 15:08:23 +0200 Subject: [PATCH 6/8] CLP-897 Preserve scan and promotion behavior across split jobs --- .github/workflows/build.yml | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9872b53..f5ddab2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,6 +29,13 @@ jobs: - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 with: version: 2026.10.0 + # Build-number refs only track a number; use the existing base commit so + # claiming a PR number does not create refs containing workflow changes. + - name: Claim PR build number + if: github.event_name == 'pull_request' + uses: SonarSource/ci-github-actions/get-build-number@v2 + env: + GITHUB_SHA: ${{ github.event.pull_request.base.sha }} - uses: SonarSource/ci-github-actions/build-maven@v2 id: build-step with: @@ -48,6 +55,12 @@ jobs: analysis: name: NEXT analysis needs: build + # Match build-maven's should_scan policy; other refs only build and deploy. + if: >- + github.event_name == 'pull_request' || + github.ref_name == github.event.repository.default_branch || + startsWith(github.ref_name, 'branch-') || + startsWith(github.ref_name, 'feature/long/') runs-on: github-ubuntu-latest-s permissions: id-token: write @@ -56,9 +69,9 @@ jobs: BUILD_NUMBER: ${{ needs.build.outputs.build-number }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1 with: - version: 2026.9.11 + version: 2026.10.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build-output-${{ needs.build.outputs.build-number }} @@ -74,7 +87,11 @@ jobs: needs: - build - analysis - if: ${{ needs.build.outputs.deployed }} + if: >- + !cancelled() + && needs.build.result == 'success' + && (needs.analysis.result == 'success' || needs.analysis.result == 'skipped') + && (needs.build.outputs.deployed) runs-on: github-ubuntu-latest-s # Public repo - use custom GitHub-hosted runner permissions: id-token: write # Required for Vault OIDC authentication From 0c0de94c02e04d73e8e56ae036edfd26ec3ef5d8 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Fri, 9 Oct 2026 15:24:46 +0200 Subject: [PATCH 7/8] CLP-897 Use the shared build-number claim without reserved env overrides --- .github/workflows/build.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f5ddab2..2f2e333 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,13 +29,6 @@ jobs: - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 with: version: 2026.10.0 - # Build-number refs only track a number; use the existing base commit so - # claiming a PR number does not create refs containing workflow changes. - - name: Claim PR build number - if: github.event_name == 'pull_request' - uses: SonarSource/ci-github-actions/get-build-number@v2 - env: - GITHUB_SHA: ${{ github.event.pull_request.base.sha }} - uses: SonarSource/ci-github-actions/build-maven@v2 id: build-step with: From 07dbea36f0e95cdf7c26c5a7771d4d6616452992 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Fri, 9 Oct 2026 15:34:29 +0200 Subject: [PATCH 8/8] CLP-994 Include analysis failures in shared notification --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2f2e333..e67accf 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -100,6 +100,7 @@ jobs: name: Notify build failure needs: - build + - analysis - promote if: >- always()