feat: implement issue #401 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/sonarcloud.yml

[don-petry]

User description

Closes #401

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Prevent duplicate SonarCloud runs from showing as failures

What Changed

• SonarCloud workflow runs are now grouped per commit so duplicate pull request runs for the same commit do not overlap
• This stops one duplicate run from being left in an action_required state, which was counted as a failure by monitoring
• The workflow still runs on pushes and pull requests to main

Impact

✅ Fewer false CI failures
✅ Cleaner pull request checks
✅ Less noisy fleet monitoring

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Improved SonarCloud scan workflow management.
  • Automatically cancels outdated scans when a newer scan starts for the same code reference.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	c4b3037	Jul 22, 2026 · 09:28	09:29

_{Updated in place by CodeAnt AI · last 5 reviews}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

PR Summary by Qodo

Add SHA-scoped concurrency to SonarCloud workflow to dedupe PR runs

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Add workflow concurrency keyed by ref+SHA to prevent duplicate PR runs.
• Cancel in-progress sibling runs to avoid lingering action_required statuses.
• Align SonarCloud workflow behavior with org CI fleet-monitor expectations.

Diagram

graph TD
A(("pull_request event")) --> B[".github/workflows/sonarcloud.yml"] --> C["Concurrency group: ref+SHA"] --> D["Job: SonarCloud scan"] --> E["SonarCloud (external)"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Ref-only concurrency group

• ➕ Simpler group key (fewer concurrent slots).
• ➕ Cancels older runs aggressively, reducing CI load.
• ➖ Can collapse distinct commits on the same ref into a single slot, losing per-commit isolation.
• ➖ May not satisfy the fleet-monitor expectation of one slot per commit.

2. Use github.head_ref (branch) instead of github.sha

• ➕ Groups by PR branch, easy to reason about for PR workflows.
• ➕ Avoids very high cardinality keys.
• ➖ Still collapses multiple commits on the same PR branch into one slot.
• ➖ Does not directly address “each commit keeps its own slot” requirement described in the workflow comment.

Recommendation: Keep the PR’s SHA-scoped concurrency key. It directly targets the reported failure mode (duplicate sibling runs leaving one action_required) while preserving per-commit isolation required by the stated org CI standards. The chosen prefix also avoids collisions with other workflows’ concurrency groups.

Files changed (1) +9 / -0

Other (1) +9 / -0

sonarcloud.ymlAdd SHA-scoped concurrency group to avoid duplicate PR workflow runs +9/-0

Add SHA-scoped concurrency group to avoid duplicate PR workflow runs

• Introduces a workflow-level concurrency group keyed by 'github.ref' and 'github.sha', with 'cancel-in-progress: true'. This prevents duplicate sibling 'pull_request' runs from leaving one run stuck in 'action_required', which the fleet monitor interprets as a failure.

.github/workflows/sonarcloud.yml

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-22T10:29:55Z.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1e4e81a7-14ff-4691-ac99-acaf928f4c5c

📥 Commits

Reviewing files that changed from the base of the PR and between 0497a08 and c4b3037.

📒 Files selected for processing (1)

• .github/workflows/sonarcloud.yml

---

📝 Walkthrough

Walkthrough

The SonarCloud workflow adds SHA-scoped concurrency and cancels an in-progress run when a newer run shares its computed group.

Changes

SonarCloud workflow

Layer / File(s)	Summary
Configure SonarCloud concurrency .github/workflows/sonarcloud.yml	Adds a git reference and commit SHA-based concurrency group with cancel-in-progress enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies issue #401 and the SonarCloud workflow change.
Linked Issues check	✅ Passed	The added concurrency control in sonarcloud.yml is relevant to the monitored workflow warning and fits the issue scope.
Out of Scope Changes check	✅ Passed	The only change is a workflow concurrency tweak directly tied to the monitored SonarCloud job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-401-20260722-0920

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: c4b3037001e2c87c0ebd7c7dcdba76330ea8485c
Review mode: triage-approved (single reviewer)

Summary

Adds a SHA-scoped concurrency group with cancel-in-progress to the SonarCloud workflow so duplicate pull_request runs for the same commit no longer linger in action_required (counted as failures by the fleet monitor). Minimal 9-line config change, no security-relevant surface, all CI green, quality gate passed.

Linked issue analysis

Closes #401 (Fleet Monitor WARNING: 10.5% failure rate on sonarcloud.yml). The failure mode was duplicate sibling runs leaving one run stuck in action_required. The SHA-scoped concurrency group with cancel-in-progress directly dedupes those sibling runs while keeping per-commit slots, so the linked issue is substantively addressed.

Findings

• No blocking findings.
• Workflow security review: no new actions introduced, no secrets exposure, no pull_request_target, no expression-injection vectors. The concurrency group key uses only github.ref and github.sha (trusted contexts).
• Secret scan: run_secret_scanning MCP tool not available in this environment; the gitleaks CI check passed (SUCCESS).
• Informational: cancel-in-progress reliably supersedes queued/in-progress sibling runs; if a duplicate run in action_required state is ever not cancelled by the concurrency group, the fleet monitor may still flag it — worth watching the next monitoring window, but this does not block the change.
• Advisory bots: CodeAnt, Qodo, and SonarCloud completed with no findings; Gemini skipped (unsupported file type); Codex was rate-limited (advisory only, non-blocking given all substantive analyzers passed).

CI status

All checks green: CodeQL (actions, python) SUCCESS; gitleaks SUCCESS; AgentShield SUCCESS; SonarCloud Analysis + Quality Gate SUCCESS (0 new issues, 0 hotspots); dependency-audit SUCCESS (ecosystem-specific audits skipped as not applicable); remaining skips are expected (dependabot-automerge, mention-trigger, ci-relay).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- No actionable findings reported (review in progress)
Files changed: .github/workflows/sonarcloud.yml
Skipped (informational): 0
Notes: CodeRabbit review still pending. All completed CI checks passing. PR ready for review completion.
```
No action required at this time. The bot review is still processing and will report any findings when complete.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: c4b3037001e2c87c0ebd7c7dcdba76330ea8485c
Review mode: triage-approved (single reviewer)

Summary

Adds a SHA-scoped concurrency group (with cancel-in-progress) to .github/workflows/sonarcloud.yml so duplicate pull_request runs for the same commit no longer linger as action_required and get counted as failures by the fleet monitor. 9 additions, 1 file, no permission or action changes. Confirms the triage-tier low-risk assessment.

Linked issue analysis

Closes #401 ([Fleet Monitor] sonarcloud.yml WARNING, 10.5% failure rate). The failures stemmed from duplicate PR runs left in action_required state; the SHA-scoped concurrency group dedupes runs per commit, directly and substantively addressing the root cause. The group prefix (sonarcloud-) keeps it distinct from ci.yml's group, per org ci-standards.

Findings

No findings. The change is a benign workflow concurrency block: no new permissions, no new actions or pins to verify, no shell/script content, no injection surfaces. Keying the group on ref+sha correctly scopes cancellation to true duplicates of one commit rather than superseding pushes. Secret scan MCP tool was unavailable in this session; the gitleaks CI check passed (SUCCESS).

CI status

All quality gates green: CodeQL (actions, python), SonarCloud + SonarCloud Code Analysis (quality gate passed), Secret scan (gitleaks), agent-shield, review/review, pr-auto-review. Skipped jobs are ecosystem-gated dependency audits; the two CANCELLED entries are dev-lead orchestration runs (dispatch/ci-relay), not code-quality gates.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: c4b3037001e2c87c0ebd7c7dcdba76330ea8485c
Review mode: triage-approved (single reviewer)

Summary

Adds a SHA-scoped concurrency group (sonarcloud-${{ github.ref }}-${{ github.sha }}, cancel-in-progress: true) to .github/workflows/sonarcloud.yml so duplicate pull_request runs GitHub occasionally emits for the same commit dedupe instead of one lingering as action_required, which the fleet monitor counted as a failure. 9 additions, 1 file, config-only.

Linked issue analysis

Closes #401 ([Fleet Monitor] sonarcloud.yml at 10.5% failure rate). The failure source was duplicate PR runs left in action_required state; SHA-scoped concurrency with cancel-in-progress dedupes those runs while keeping per-commit slots (per org ci-standards) and remaining distinct from ci.yml's group via the sonarcloud- prefix. The issue is substantively addressed.

Findings

• No security concerns: no permission changes, no new actions, no expression-injection surface (group uses only github.ref/github.sha contexts).
• Semantics verified: duplicate runs for the same commit share ref+sha and dedupe; new commits and push-vs-PR events get distinct groups, so no unintended cancellations.
• Minor note (non-blocking): for pull_request events github.sha is the merge commit, so dedup is not guaranteed if the base advances between duplicate deliveries — acceptable for the targeted failure mode.
• Secret scanning MCP tool unavailable in this environment; gitleaks CI check passed.
• Prior automated reviews at this same SHA approved (risk=LOW); no unresolved review threads, no unanswered human questions.

CI status

All substantive checks green: CodeQL SUCCESS, SonarCloud + quality gate SUCCESS, gitleaks SUCCESS, AgentShield SUCCESS, review/review SUCCESS. Two cancelled dev-lead dispatch/ci-relay jobs are superseded orchestration duplicates, not test failures. Advisory bots (Qodo: 0 bugs/0 violations, CodeAnt, CodeRabbit) reported no issues.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.