[rmcdaniel]

Outcome

Use SonarQube Cloud across the product repositories as a maintained source-quality check, with accurate repository badges and meaningful review of findings.

Acceptance

• Each repository is bound to its corresponding Sonar project; private source and results remain private.
• CI scans the exact checked-out revision, reports its quality gate, and preserves PR comments, annotations and checks.
• Forks receive no analysis credential. Approved actions are pinned, and scanner credentials are scoped to the scan step.
• Sources and tests are classified deliberately; generated files, dependencies and disposable outputs are excluded.
• Coverage is imported when a real report exists; missing coverage is never presented as measured coverage.
• Existing test, release and deployment checks remain required. Valid findings are fixed or explicitly triaged, with no blanket acceptance to manufacture a green gate.
• Readable setup and triage instructions describe the quality profile, gate, notification path and maintenance responsibility.

Server changes are limited to a separately coordinated CI/configuration/README window. No runtime, native/shared fixture, package version or frozen actor change is part of this task.
The Sonar integration exposed the same existing PHPStan failure on all three maintained PHP/Laravel jobs: E2bSandboxProvider.php:109 checks is_array($body) again after nonempty sandboxID validation has already established that fact. The invalid-response guard at the first read remains necessary.

Remove only the redundant second conditional, retain malformed/missing-ID refusal and default-template metadata, and verify with fake HTTP responses plus the normal formatting/static/test matrix. No real E2B calls, provider provisioning, credentials or dependency constraints need to change. This restores the existing CI gate and unblocks the Sonar rollout in #21; it is not evidence of a customer provisioning failure.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud