[don-petry]

Closes #378

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Improved automated quality checks so temporary scanner issues don’t immediately fail the workflow.
  • Added logic to retry only when the initial scan fails, avoiding duplicate scans on success.
  • No changes to end-user functionality.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5c5c3d18-dbe5-4824-b636-c1250b4f420d

📥 Commits

Reviewing files that changed from the base of the PR and between eb8e764 and aa81a43.

📒 Files selected for processing (1)

• .github/workflows/sonarcloud.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/sonarcloud.yml

---

📝 Walkthrough

Walkthrough

The SonarCloud workflow now tolerates an initial scan failure and runs the retry step only when that scan reports failure.

Changes

SonarCloud workflow

Layer / File(s)	Summary
Initial scan and retry handling .github/workflows/sonarcloud.yml	The initial scan uses continue-on-error: true; the retry step runs only when the initial step outcome is failure.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• petry-projects/TalkTerm#10: Modifies the same SonarCloud workflow’s conditional scan and retry behavior.

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is specific, concise enough, and accurately points to the SonarCloud workflow change tied to issue #378.
Linked Issues check	✅ Passed	The workflow changes directly address the degraded SonarCloud job by reducing false failures and keeping the retry path on initial scanner failure.
Out of Scope Changes check	✅ Passed	The PR stays scoped to the SonarCloud workflow and does not introduce unrelated code or config changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-378-20260719-0847

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #383
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-19T09:20:37Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-19T09:20:37Z

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-19T09:51:02Z.

[Copilot]

Pull request overview

Improves CI reliability by making the SonarCloud Analysis workflow resilient to transient Sonar scanner CLI download failures (as tracked in issue #378), without re-running successful scans.

Changes:

• Mark the initial SonarCloud scan step as continue-on-error to allow a conditional recovery path.
• Add a single conditional retry step that runs only when the first scan attempt fails.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #383
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-19T10:36:24Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-19T10:36:24Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: aa81a43cf3d74da54c26bf9c6d3cee9d0490266a
Review mode: triage-approved (single reviewer)

Summary

Adds a single retry to the SonarCloud scan workflow: the initial scan step now uses continue-on-error: true, and a retry step (same SHA-pinned action, same SONAR_TOKEN guard) runs only when steps.sonar.outcome == 'failure'. A healthy first attempt is never scanned twice, and a persistent failure still fails the job because the retry step has no continue-on-error. Correctly uses outcome (pre-continue-on-error result) rather than conclusion for the retry condition.

Linked issue analysis

Closes #378 (Fleet Monitor: sonarcloud.yml DEGRADED, 33.3% failure rate over 6 runs, attributed to transient 403/5xx from binaries.sonarsource.com during scanner CLI download). The retry-on-transient-failure pattern directly and substantively addresses the degradation without masking real failures.

Findings

• No security concerns: both steps remain pinned to the same commit SHA (7138816… / v8.2.0), no permission changes, no new triggers, no secret exposure, no injection vectors.
• Correctness verified: steps.sonar.outcome is the correct property under continue-on-error; double-failure still fails the job; SONAR_TOKEN guard preserved on both steps.
• Secret scanning MCP tool (run_secret_scanning) was not available in this environment; the gitleaks CI check passed on the head commit.
• Note: branch is BEHIND base (mergeable; auto-rebase/update expected to handle before merge).

CI status

All checks green on aa81a43cf3d74da54c26bf9c6d3cee9d0490266a: CodeQL (actions + python), gitleaks secret scan, AgentShield, SonarCloud Analysis + Quality Gate (0 new issues, 0 hotspots), CodeRabbit, dependency-audit (ecosystem jobs skipped by design). No failing or cancelled checks.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud