attest sonar fails on a SonarQube Cloud short-lived branch via report-task.txt or --sonar-ce-task-url #1296

kosli attest sonar fails on a SonarQube Cloud short-lived branch when it finds the scan through report-task.txt or --sonar-ce-task-url:

Error: SonarQube error: Branch 'run-workflow-196' is not of type LONG

#1294 is the same error on the project-key path. #1295 fixes that path only.

Why

We read the scan's revision and date from api/project_analyses/search. SonarCloud only serves that endpoint for long-lived branches (web API spec: branch is "Key of a long lived branch").

On this path we know the scan's analysis ID, not its commit. For a short-lived branch, api/project_branches/list gives only the commit of the branch's latest analysis. Nothing a normal token can read links an analysis ID to a commit (api/ce/activity needs project admin).

How we proved it

Built kosli from main. Ran both paths through a local proxy that serves api/ce/task from a file and forwards every other call to sonarcloud.io. We faked only api/ce/task because it needs a token we don't have. The failing call, api/project_analyses/search on public project cyber-dojo_differ, branch run-workflow-196, is real.