From 19c762403b4f2e73235451b46594ddcb0e76ba50 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:51:18 +0100 Subject: [PATCH] fix(ci): remove the unrunnable SonarCloud step breaking Governance + CodeQL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `SonarSource/sonarqube-scan-action@master` was appended to four workflows by a sweep. The root copy is live and breaks CI two different ways: - governance / Workflow security linter ERROR: Found unpinned actions: .github/workflows/codeql.yml:58: uses: SonarSource/sonarqube-scan-action@master - CodeQL Security Analysis ##[error]The action sonarsource/sonarqube-scan-action@master is not allowed in hyperpolymath/maa-framework because all actions must be pinned to a full-length commit SHA. The second is a *startup* rejection by the org ruleset, so the analyze job died with zero steps — no lint-shaped error, and no check run to inspect. Removed rather than pinned, because pinning alone cannot make it work: - no `SONAR_TOKEN` secret exists on this repo (verified via `gh secret list`) - no sonar-project.properties / sonar config anywhere in the tree - the step carries no `with:` or `env:`, so it has no project key or org - it was appended *inside the CodeQL matrix job*, so it would run once per language, and in two files it was jammed between a step and the next job key with no blank line Pinning it would have swapped a pin error for an auth error and left main red. Also removes the three copies under aletheia/ — those workflows are inert (Actions reads .github/workflows/ at the repo root only), but leaving them would re-introduce the defect the moment anyone promotes one to the root. Restores the trailing newlines the sweep dropped. To adopt SonarCloud properly later: one root workflow only, pinned to a SHA, with SONAR_TOKEN wired and a sonar-project.properties committed. Verified: all four files parse (`yq`); job keys intact (test/security/coverage, check/test/build/self-verify); both governance linter checks pass locally. Co-Authored-By: Claude Opus 5 --- .github/workflows/codeql.yml | 3 --- aletheia/.github/workflows/codeql.yml | 3 --- aletheia/.github/workflows/rust-ci.yml | 2 -- aletheia/extraction/rhodibot/.github/workflows/ci.yml | 2 -- 4 files changed, 10 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 010780d..3a9e51f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -53,6 +53,3 @@ jobs: uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 with: category: "/language:${{ matrix.language }}" - - - name: SonarCloud Scan - uses: SonarSource/sonarqube-scan-action@master \ No newline at end of file diff --git a/aletheia/.github/workflows/codeql.yml b/aletheia/.github/workflows/codeql.yml index c5b14d4..741d0c1 100644 --- a/aletheia/.github/workflows/codeql.yml +++ b/aletheia/.github/workflows/codeql.yml @@ -40,6 +40,3 @@ jobs: uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: category: "/language:${{ matrix.language }}" - - - name: SonarCloud Scan - uses: SonarSource/sonarqube-scan-action@master \ No newline at end of file diff --git a/aletheia/.github/workflows/rust-ci.yml b/aletheia/.github/workflows/rust-ci.yml index 4395614..a7e5190 100644 --- a/aletheia/.github/workflows/rust-ci.yml +++ b/aletheia/.github/workflows/rust-ci.yml @@ -28,8 +28,6 @@ jobs: - name: Build release run: cargo build --release - - name: SonarCloud Scan - uses: SonarSource/sonarqube-scan-action@master security: runs-on: ubuntu-latest timeout-minutes: 15 diff --git a/aletheia/extraction/rhodibot/.github/workflows/ci.yml b/aletheia/extraction/rhodibot/.github/workflows/ci.yml index 24a397c..6a873a3 100644 --- a/aletheia/extraction/rhodibot/.github/workflows/ci.yml +++ b/aletheia/extraction/rhodibot/.github/workflows/ci.yml @@ -45,8 +45,6 @@ jobs: exit 1 fi - - name: SonarCloud Scan - uses: SonarSource/sonarqube-scan-action@master test: name: Test runs-on: ubuntu-latest