CLP-994 Split build from analysis for sonar-java-jdt

.github/workflows/build.yml

@@ -35,12 +35,56 @@ jobs:
           deploy-pull-request: true
           artifactory-reader-role: private-reader    # Override default public-reader
           artifactory-deployer-role: qa-deployer     # Override default public-deployer
+          sonar-platform: none
+          maven-args: -Pcoverage
+      - name: Upload Maven build as pipeline artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-output-${{ steps.build-step.outputs.BUILD_NUMBER }}
+          path: '**/target'
+          retention-days: 7
+          overwrite: true
+
+  analysis:
+    name: NEXT analysis
+    needs: build
+    # Match build-maven's should_scan policy; other refs only build and deploy.
+    if: >-
+      github.event_name == 'pull_request' ||
+      github.ref_name == github.event.repository.default_branch ||
+      startsWith(github.ref_name, 'branch-') ||
+      startsWith(github.ref_name, 'feature/long/')
+    runs-on: github-ubuntu-latest-s
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        with:
+          version: 2026.10.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-output-${{ needs.build.outputs.build-number }}
+      - uses: SonarSource/ci-github-actions/build-maven@v2
+        with:
+          deploy: false
+          skip-build: true
+          sonar-platform: next
+          artifactory-reader-role: private-reader
 
   promote:
     name: Promote
     needs:
      - build
-    if: ${{ needs.build.outputs.deployed }}
+     - analysis
+    if: >-
+      !cancelled()
+      && needs.build.result == 'success'
+      && (needs.analysis.result == 'success' || needs.analysis.result == 'skipped')
+      && (needs.build.outputs.deployed)
     runs-on: github-ubuntu-latest-s  # Public repo - use custom GitHub-hosted runner
     permissions:
       id-token: write  # Required for Vault OIDC authentication
@@ -56,6 +100,7 @@ jobs:
     name: Notify build failure
     needs:
       - build
+      - analysis
       - promote
     if: >-
       always()