From 29fefda4a3187a55eb8b61ea0b793166c61218a2 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Mon, 5 Oct 2026 17:22:37 +0200 Subject: [PATCH 1/3] CLP-996 Split Maven build from NEXT analysis Keep build, tests, coverage, and deployment in the producer job. Upload the target directories for a scanner-only analysis job that can be rerun independently, and gate promotion on its result. --- .github/workflows/build.yml | 39 ++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e2551beb..126f7684 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -37,6 +37,16 @@ jobs: artifactory-deployer-role: qa-deployer use-develocity: true develocity-url: https://develocity-public.sonar.build/ + sonar-platform: none + maven-args: -Pcoverage + + - name: Upload plugin build as pipeline artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: build-output-${{ steps.build.outputs.BUILD_NUMBER }} + path: '**/target' + retention-days: 7 + overwrite: true - name: Prepare PVF candidate version if: ${{ steps.build.outputs.deployed }} @@ -44,6 +54,32 @@ jobs: with: build-version: ${{ steps.build.outputs.project-version }} + analysis: + name: NEXT analysis + needs: build + runs-on: github-ubuntu-latest-m + permissions: + id-token: write + contents: read + env: + BUILD_NUMBER: ${{ needs.build.outputs.build-number }} + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0 + with: + version: 2026.9.18 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: build-output-${{ needs.build.outputs.build-number }} + - uses: SonarSource/ci-github-actions/build-maven@v2 + with: + deploy: false + skip-build: true + sonar-platform: next + artifactory-reader-role: private-reader + use-develocity: true + develocity-url: https://develocity-public.sonar.build/ + build-win: name: Build Windows needs: @@ -149,6 +185,7 @@ jobs: promote: needs: - build + - analysis - build-win - qa if: ${{ needs.build.outputs.deployed }} @@ -165,7 +202,7 @@ jobs: promote-pull-request: true notify-build-failure: - needs: [build, build-win, qa, promote] + needs: [build, analysis, build-win, qa, promote] if: >- always() && (github.ref_name == github.event.repository.default_branch || startsWith(github.ref, 'refs/heads/branch-') || startsWith(github.ref, 'refs/heads/dogfood-')) From debe6bd2b16d8c9178eaad4cc7726701f108d78e Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Fri, 9 Oct 2026 15:08:23 +0200 Subject: [PATCH 2/3] CLP-897 Preserve scan and promotion behavior across split jobs --- .github/workflows/build.yml | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 126f7684..46455598 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,6 +29,13 @@ jobs: - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1 with: version: 2026.10.0 + # Build-number refs only track a number; use the existing base commit so + # claiming a PR number does not create refs containing workflow changes. + - name: Claim PR build number + if: github.event_name == 'pull_request' + uses: SonarSource/ci-github-actions/get-build-number@v2 + env: + GITHUB_SHA: ${{ github.event.pull_request.base.sha }} - uses: SonarSource/ci-github-actions/build-maven@v2 id: build with: @@ -57,6 +64,12 @@ jobs: analysis: name: NEXT analysis needs: build + # Match build-maven's should_scan policy; other refs only build and deploy. + if: >- + github.event_name == 'pull_request' || + github.ref_name == github.event.repository.default_branch || + startsWith(github.ref_name, 'branch-') || + startsWith(github.ref_name, 'feature/long/') runs-on: github-ubuntu-latest-m permissions: id-token: write @@ -65,9 +78,9 @@ jobs: BUILD_NUMBER: ${{ needs.build.outputs.build-number }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0 + - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1 with: - version: 2026.9.18 + version: 2026.10.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build-output-${{ needs.build.outputs.build-number }} @@ -188,7 +201,13 @@ jobs: - analysis - build-win - qa - if: ${{ needs.build.outputs.deployed }} + if: >- + !cancelled() + && needs.build.result == 'success' + && needs.build-win.result == 'success' + && needs.qa.result == 'success' + && (needs.analysis.result == 'success' || needs.analysis.result == 'skipped') + && (needs.build.outputs.deployed) runs-on: github-ubuntu-latest-s # Custom GitHub-hosted runner for public repos name: Promote permissions: From de0c9f0c54718d6adabcb6706f1f60f5892636d8 Mon Sep 17 00:00:00 2001 From: Guillaume Dequenne Date: Fri, 9 Oct 2026 15:24:46 +0200 Subject: [PATCH 3/3] CLP-897 Use the shared build-number claim without reserved env overrides --- .github/workflows/build.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 46455598..16dab0b6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,13 +29,6 @@ jobs: - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1 with: version: 2026.10.0 - # Build-number refs only track a number; use the existing base commit so - # claiming a PR number does not create refs containing workflow changes. - - name: Claim PR build number - if: github.event_name == 'pull_request' - uses: SonarSource/ci-github-actions/get-build-number@v2 - env: - GITHUB_SHA: ${{ github.event.pull_request.base.sha }} - uses: SonarSource/ci-github-actions/build-maven@v2 id: build with: