chore(ci): move Sonar to daily scheduled workflow

Sonar on every push/PR was overkill — adds ~1m to every CI run and
churns SonarCloud quota. Moved to its own workflow running daily at
07:00 UTC plus on-demand via workflow_dispatch.

CI workflow reverts to plain build/test on the full matrix.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: dfa1

.github/workflows/ci.yml

@@ -18,9 +18,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-        with:
-          # Sonar needs full history for line-level blame / new-code computation.
-          fetch-depth: ${{ (matrix.os == 'ubuntu-latest' && matrix.java-version == '25') && 0 || 1 }}
 
       - name: Set up Azul Zulu JDK ${{ matrix.java-version }}
         uses: actions/setup-java@v5
@@ -36,35 +33,13 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
 
-      - name: Cache SonarCloud packages
-        if: matrix.os == 'ubuntu-latest' && matrix.java-version == '25'
-        uses: actions/cache@v5
-        with:
-          path: ~/.sonar/cache
-          key: ${{ runner.os }}-sonar
-          restore-keys: ${{ runner.os }}-sonar
-
       # vortex-jni 0.74.0 ships native libs for darwin-aarch64 + linux-aarch64
       # + linux-amd64 only. No Windows binary, so the modules that pull vortex-jni
       # (integration, performance) are skipped on Windows. Being the only Vortex
       # impl that runs on Windows JVMs is one of vortex-java's selling points —
       # see README "Who is this for".
-      # JaCoCo coverage is collected only on the Ubuntu + Java 25 entry — running it on
-      # every matrix entry would produce redundant reports and slow the build.
-      - name: Build, test, and Sonar analysis (Linux)
-        if: matrix.os == 'ubuntu-latest' && matrix.java-version == '25'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: |
-          ./mvnw verify -P coverage \
-            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-            -Dsonar.projectKey=dfa1_vortex-java \
-            -Dsonar.organization=dfa1 \
-            -Dsonar.host.url=https://sonarcloud.io
-
-      - name: Build and test (Linux + macOS) without coverage
-        if: runner.os != 'Windows' && !(matrix.os == 'ubuntu-latest' && matrix.java-version == '25')
+      - name: Build and test (Linux + macOS)
+        if: runner.os != 'Windows'
         run: ./mvnw verify
 
       - name: Build and test (Windows)

.github/workflows/sonar.yml

@@ -0,0 +1,51 @@
+name: Sonar
+
+# SonarCloud analysis runs once per day (07:00 UTC) on main, plus on-demand
+# via the workflow_dispatch button. Kept out of the per-push CI workflow to
+# keep PRs fast and reduce SonarCloud quota usage.
+on:
+  schedule:
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+
+jobs:
+  sonar:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # Full history needed for line-level blame / new-code computation.
+          fetch-depth: 0
+
+      - name: Set up Azul Zulu JDK 25
+        uses: actions/setup-java@v5
+        with:
+          distribution: zulu
+          java-version: '25'
+
+      - name: Cache Maven repository
+        uses: actions/cache@v5
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v5
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: Build, test, and Sonar analysis
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          ./mvnw verify -P coverage \
+            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
+            -Dsonar.projectKey=dfa1_vortex-java \
+            -Dsonar.organization=dfa1 \
+            -Dsonar.host.url=https://sonarcloud.io