[guillaume-dequenne]

Part of CLP-897

Summary

• Split the Maven build/deploy producer from the NEXT analysis consumer.
• Upload the exact Maven target outputs as a three-day artifact and restore them for the scan.
• Reuse the same build number and Maven scan configuration so the analysis remains equivalent.
• Keep promotion and releasability gated by the scan.

Dependency

• Scanner-only mode is provided by PREQ-8698 Add skip build option to maven build ci-github-actions#348 and is currently pinned to its reviewed commit. Re-pin to v1 or v2 once that PR is merged.

Validation

• Parsed the updated workflow as YAML.
• Ran actionlint, accounting for existing Sonar-specific workflow extensions.
• Ran git diff --check.

[hashicorp-vault-sonar-prod]

CLP-897

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Separates Maven deployment and scanning through artifact transfer and new job gating.

Splits the Maven build/deploy producer from the NEXT analysis consumer, uploading target outputs as a three-day artifact and restoring them for the scan. Reuse of the same build number and Maven configuration keeps analysis equivalent while gating promotion and releasability by the scan. No issues found.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}