Repository navigation
fix(sonar): attest a SonarQube Cloud short-lived branch scan found by its CE task - #1297
Merged
Merged
Conversation
SonarQube Cloud serves api/project_analyses/search only for long-lived branches, so --sonar-branch on a feature branch failed with "Branch '...' is not of type LONG". When the search fails and the branch is listed as short-lived, use its latest analysis from api/project_branches/list and its quality gate by project key and branch. The revision must be that latest commit, checked again after reading the gate in case a newer push was processed in between. Fixes #1294 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rmed The check after reading a short-lived branch's quality gate let the attestation through when the second branch listing failed or no longer listed the branch, so a gate of another commit could be attested. Fail instead, and decide "gate is the branch's latest" in one place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…irmed The branch lookup now reports a non-2xx response as an error, so the re-check after reading the gate keeps the HTTP status, and a branch no longer listed is named as the cause. When a newer analysis has replaced the attested revision, the error says so rather than suggesting a retry that cannot help. search: grep -nE 'isShort|shortLivedBranchAnalysis' internal/sonar/sonar.go 465-466 the first lookup in GetProjectAnalysisFromRevision, still the only caller; 499/504 its definition. The re-check no longer calls it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… its CE task report-task.txt and --sonar-ce-task-url failed on a short-lived branch, because SonarCloud's analyses search refuses those branches. The branch list gives the commit of the branch's latest analysis only. We use it when api/ce/component, read after the list, shows our task as the project's last finished task and no task is in progress. All three short-lived branch lookups now go through one function, shortLivedBranchAnalysis. Each path only says how it knows the branch's latest analysis is the one it attests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… into claude/sonar-short-branch-ce-task # Conflicts: # internal/sonar/sonar.go
mbevc1
previously approved these changes
Oct 23, 2026
…anch-ce-task # Conflicts: # internal/sonar/sonar.go
Contributor
|
Claude finished @AlexKantor87's task in 34s —— View job Follow-up review — new commits
What changed between the two commits: the only new commit ( Previous findings: none to report — there is no prior Claude review on this PR with findings to reconcile. The only existing review (by New issues: none found — no inline comments posted, since no logic changed. |
mbevc1
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1296.
Ships in the same release as #1295. #1295 is merged; this PR is now based on main.
What it fixes
kosli attest sonarfailed with "Branch '...' is not of type LONG" on a SonarQube Cloud short-lived branch when it found the scan throughreport-task.txtor--sonar-ce-task-url. #1295 fixed the project-key path only.How
On these paths we know the scan's analysis ID, not its commit. For a short-lived branch, SonarCloud gives only the commit of the branch's latest analysis (
api/project_branches/list). We use it only when that analysis is ours. After listing the branch,api/ce/componentmust show our task as the project's last finished task. No task that could be on the branch may be running. That endpoint needs only Browse permission. A running task counts because SonarQube saves a scan's analysis before it records the task as finished.The first lookup on both paths (project key and CE task) now goes through one function,
shortLivedBranchAnalysis, built on #1295'slistedShortLivedBranch. Each path only says how it knows the branch's latest analysis is the one it attests.Limits
--sonar-project-keywith--sonar-revision.Tested
cli-suite.shgreen against a local server.cyber-dojo_differ, branchrun-workflow-196. Latest commit attests; another commit is refused.aelassas_servy, branchnet48, attested commit5c50372, which matches GitHub's branch head. We served onlyapi/ce/taskfrom a captured copy, since it needs Execute Analysis.report-task.txtruns the same code after reading the file.🤖 Generated with Claude Code