[Fleet Monitor] petry-projects/repo-template — .github/workflows/sonarcloud.yml #137

Activity

1. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   fleet-trackerTracked by the Actions Fleet MonitorTracked by the Actions Fleet Monitor

   health-checkAutomated health check resultAutomated health check result

   on Aug 7, 2026
2. don-petry commented on Aug 7, 2026

   

   don-petry

   on Aug 7, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #137 — [Fleet Monitor] petry-projects/repo-template — .github/workflows/sonarcloud.yml

   Scope

   Insert a short backoff wait between the initial SonarCloud scan and its single retry so a transient endpoint blip does not fail both attempts back-to-back, reducing the workflow's flaky failure rate (currently 11.8%, above the 10% threshold).

   Root cause

   sonarcloud.yml already follows the org "continue-on-error first scan + single retry" convention, but the retry fires immediately after the first failure. SonarCloud's analysis endpoint is occasionally flaky for a short window; an immediate retry frequently lands inside the same outage, so both attempts fail and the job goes red. A brief backoff lets the endpoint recover before the retry.

   Implementation Checklist

   • .github/workflows/sonarcloud.yml — add a Back off before retry step (sleep) gated on steps.sonar.outcome == 'failure', placed between the first scan and the retry; leave job name, permissions, triggers, SHA pins, and the single-retry shape unchanged.

   Tests to Write

   • tests/sonarcloud-stub.bats (new drift/behavior guard):
     • a backoff step exists between the failed scan and the retry, gated on the same failure condition (core red test)
     • job name stays SonarCloud (required status check)
     • top-level permissions: {} and job perms are exactly contents: read + pull-requests: read
     • triggers are push + pull_request to main; checkout uses fetch-depth: 0
     • the single-retry pattern is preserved (first scan continue-on-error, retry gated on failure)
     • every third-party action is SHA-pinned; no TODO/FIXME marker (SonarCloud S1135 guard)

   Test Command

   bats tests/sonarcloud-stub.bats (full suite: bats tests/*.bats)
3. don-petry commented on Aug 7, 2026

   

   don-petry

   on Aug 7, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Root cause

   sonarcloud.yml already implemented the org "continue-on-error first scan + single retry" convention, but the retry fired immediately after the first failure. SonarCloud's analysis endpoint is occasionally flaky for a short window, so an immediate retry frequently lands inside the same outage — both attempts fail together and the job goes red. That is the ~11.8% flaky failure rate the Fleet Monitor flagged.

   Fix

   Inserted a short backoff (sleep 30) between the failed first scan and the retry, gated on the same steps.sonar.outcome == 'failure' condition so it runs only on the retry path. This lets the endpoint recover before the second attempt without touching the common green path (p50 unaffected; only retry runs pay the extra 30s).

   Plan Execution

   • .github/workflows/sonarcloud.yml — added Back off before retry step between the first scan and the retry; job name (SonarCloud), permissions: {} + job read scopes, push/PR-to-main triggers, fetch-depth: 0, single-retry shape, and SHA pins all left unchanged
   • tests/sonarcloud-stub.bats — new behavior + drift guard (9 tests)

   Test Results

   1..9
   ok 1 sonarcloud workflow exists
   ok 2 job name is the required 'SonarCloud' status check
   ok 3 first scan is continue-on-error and the retry is gated on its failure
   ok 4 a backoff step waits between the failed scan and the retry (issue #137)
   ok 5 top-level permissions are locked down to {}
   ok 6 job grants exactly the read scopes the scan needs
   ok 7 triggers are push + pull_request to main and checkout uses fetch-depth: 0
   ok 8 every third-party action is pinned to a full-length commit SHA
   ok 9 stub carries no TODO/FIXME marker (SonarCloud githubactions:S1135 regression guard)
   

   Test 4 was written first and confirmed red against the pre-fix file, then went green after the backoff step was added (TDD). Repo lint (.dev-lead/scripts/dev-lead-lint.sh) passes; sonarcloud.yml is valid YAML.

   Files Changed

   • .github/workflows/sonarcloud.yml: added a gated Back off before retry (sleep 30) step between the initial scan and its retry; updated the CONVENTIONS header comment to note the backoff.
   • tests/sonarcloud-stub.bats: new drift/behavior guard pinning the backoff ordering + gate and the workflow invariants (job name, permissions, triggers, retry shape, SHA pinning, no TODO/FIXME).

   Notes

   • Pre-existing failures in the full bats tests/*.bats run (14 tests: *-stub is byte-identical to the canonical template, .gitignore secrets-baseline / ignore-pattern checks, etc.) are unrelated to this change — they require org canonical files that are fetched from petry-projects/.github and are absent in the sandbox. The failure set is identical before and after this change; this change adds 9 new passing tests and introduces no regressions.
   • The backoff only runs on the retry path, so it does not affect p50 duration; a retried run's wall time rises by ~30s, which is acceptable for a rare path.
   • sonarcloud.yml is a copy of the org source of truth (petry-projects/.github/standards/workflows/sonarcloud.yml); the same backoff should be applied upstream so the template and its consumers do not drift.
4. don-petry commented on Aug 10, 2026

   

   don-petry

   on Aug 10, 2026

   ContributorAuthor

   More actions

   ✅ Auto-resolved by Fleet Monitor. This workflow's failure rate has been below the 10% threshold (or the workflow was removed) since 2026-08-07 (3 days) — the monitor stopped flagging it. Closing. It will reopen automatically if the workflow crosses the threshold again.
5. don-petry

   closed this as completedon Aug 10, 2026
6. don-petry

   added 8 commits that reference this issue on Aug 13, 2026

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   ab33a53

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   8d256f0

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   c97df68

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   a79c531

   feat: implement issue #137 — SonarCloud retry backoff + drift-guard t…

   ...

   5e0b831

   feat: implement issue #137 — SonarCloud retry backoff + drift-guard t…

   ...

   24ebafd

   feat: implement issue #137 — SonarCloud retry backoff + drift-guard t…

   ...

   81ac2bc

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   88b5152
7. don-petry

   added 6 commits that reference this issue on Sep 12, 2026

   fix(ci): restore job timeouts, apt retry, gitleaks retry, and sonarcl…

   ...

   e9a2649

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   a2080b9

   fix(ci): restore job timeouts, apt retry, gitleaks retry, and sonarcl…

   ...

   ea130e6

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   7512b04

   feat: implement issue #137 — [Fleet Monitor] petry-projects/repo-temp…

   ...

   b8cf60c

   fix(ci): restore job timeouts, apt retry, gitleaks retry, and sonarcl…

   ...

   4d2c3a9