fix(sonar): forward branch name to project_analyses/search

[mbevc1]

SonarQube's project_analyses/search endpoint defaults to the main branch when no branch param is supplied, so kosli attest sonar could not locate analyses on non-default branches and failed with "analysis with ID not found". The CE task response already exposes the branch name; forward it on the lookup.

Also adds Sonar testing.

Related: #861

[claude]

Claude finished @mbevc1's task in 1m 55s —— View job

---

PR Review: fix(sonar): forward branch name to project_analyses/search

• Run static analysis (build, vet, mod tidy)
• Review code changes
• Post review feedback

---

Static Analysis

All checks pass:

• go build ./... — clean
• go vet ./... — clean
• go mod tidy — no diff

Code Review

The fix is correct and well-targeted. GetCETaskData populates sonarResults.Branch from the CE task response (line 369-372), and GetProjectAnalysisFromAnalysisID is called immediately after (line 226). Forwarding the branch param at that point is the right place.

I verified that the other caller of project_analyses/search — GetProjectAnalysisFromRevision (line 383) — is not affected: it's called on the fallback path where no CE task URL exists, and sonarResults.Branch hasn't been populated yet at that point. So the fix is correctly scoped to only GetProjectAnalysisFromAnalysisID.

Tests are solid. Two clean cases covering the fix:

1. Branch present → branch param forwarded, correct analysis returned
2. Branch nil → no branch param sent, preserving existing behavior

Both tests use httptest.NewServer to verify the actual HTTP request, which is the right level of verification for this kind of bug.

Minor observations

• The comment on line 429 is good — it captures the why (SonarQube defaults to main) in one line, which is the useful part. The previous review's suggestion was already addressed.
• The Branch.Name != "" guard (line 431) is technically redundant since GetCETaskData only sets Branch when task.Branch != "", but it's a reasonable defensive check for a public function. Left an inline note.

Summary

Clean, minimal fix for a real bug. The change is well-scoped, the tests verify the right behavior, and it doesn't touch any unrelated code. Looks good to merge.