PREQ-8698 Add skip build option to maven build by mary-georgiou · Pull Request #348 · SonarSource/ci-github-actions

mary-georgiou · 2026-09-15T13:12:14Z

Part of CLP-466

Summary by Gitar

Build Options:
- Added skip-build input to action.yml and build.sh to run Sonar analysis against pre-built target/ output without compiling or deploying
- Added validation check to ensure skip-build cannot be enabled unless deploy is set to false
- Added check_build_output_restored validation to fail early if expected target/classes output is missing on disk

_{This will update automatically on new commits.}

hashicorp-vault-sonar-prod · 2026-09-15T13:12:35Z

check, tests, docs - Enforce that skip-build:true requires deploy:false, failing loudly at script start instead of silently never deploying if a caller leaves deploy at its true default. - Extract the build/deploy block into build_and_deploy() to isolate the skip-build branching from unrelated reindentation noise. - Add check_build_output_restored(): fails loudly if no target/classes directory is present when skip-build is enabled and scanning, instead of letting the Sonar scanner silently produce a degraded analysis against missing/incomplete restored output. - Document skip-build in README.md's build-maven inputs table. - Add shellspec coverage for the new validation guard, check_build_output_restored(), and the skip-build path through build_maven(). Full suite verified locally: 40 examples, 0 failures.

- Add || exit fallbacks to the new pushd/popd calls in build-maven_spec.sh (shellcheck SC2164). - Shorten and re-pad the skip-build row in README.md's inputs table so its column widths match the rest of the table (markdownlint MD060 table-column-style).

gitar-bot · 2026-09-15T13:54:07Z

Code Review ✅ Approved 3 resolved / 3 findings

Adds a skip-build option to the Maven build action. Skip-build silently no-ops deploy and unanalyzed branches, the README inputs table now documents the new input, and test coverage includes the SKIP_BUILD branch. No issues remain.

✅ 3 resolved

✅ Edge Case: skip-build silently no-ops deploy and unanalyzed branches

📄 build-maven/build.sh:154 📄 build-maven/build.sh:192-198 📄 build-maven/build.sh:201 📄 build-maven/action.yml:19-25 📄 build-maven/action.yml:224-225 📄 build-maven/action.yml:247-248
With skip-build: true the script skips the whole build/deploy block unconditionally, so two combinations end in a silently green job with nothing done: (a) deploy left at its default true on master/maintenance/dogfood/long-lived branches — should_deploy is never consulted, deployed is never written to $GITHUB_OUTPUT, and the downstream Artifacts upload, Generate provenance attestation and deployment summary steps in action.yml all skip while the caller believes it deployed; (b) a branch where should_scan returns 1 (short-lived branch, or sonar-platform: none with shadow scans off) — the build is skipped and no scan runs, so build.sh exits 0 having performed no work at all. Guard the combination explicitly: warn (or fail) when SKIP_BUILD=true and should_deploy, and warn when SKIP_BUILD=true and should_scan is false, so a misconfigured scanner-only job is visible instead of a green no-op.

✅ Quality: New skip-build input missing from README inputs table

📄 build-maven/action.yml:19-25
The build-maven inputs table in README.md documents every other input of the action (deploy, deploy-pull-request, maven-args, provenance, ...) but the newly added skip-build is absent, so the only place it is described is action.yml. Add a row to the table (and ideally a short subsection explaining the scanner-only job pattern with deploy: false) to keep the documented input list complete.

✅ Quality: No spec coverage for the SKIP_BUILD branch

📄 build-maven/build.sh:154-168
spec/build-maven_spec.sh asserts the exact stdout line sequence for every existing branch case, but no example sets SKIP_BUILD=true, so the new branch in build_maven (no mvn deploy/install, no deployed output, scan still executed) is entirely untested and a regression that re-enables the build or drops the scan would pass CI. Add examples covering SKIP_BUILD=true on an analyzed branch (expects the skip message plus orchestrate_sonar_platforms, and no mvn deploy/mvn install) and on the default branch with DEPLOY=true (asserting no deployed=true output).

Review coverage

Functional validation 3 of 5 objectives covered

Rules No rules evaluated

Auto-approval Not enabled · Set up

Implementation Status ◻️ 3 of 5 objectives covered

◻️ CLP-738 - 3 of 5 objectives covered

This PR adds the skip-build option to the maven build action to separate build artifact production from scanning consumption.

Other objectives on this issue, possibly covered elsewhere:

◻️ Name the workflow/action files changed, dependencies on any parent-level decision, the controlled CI proof, and a safe rollback path where external effects exist.
◻️ Revalidate the current workflow and open pull requests before editing; if already completed, document that finding and do not duplicate it.

✅ 3 covered here

✅ Use a retained, exact producer artifact for a run-local or supported retry consumer; do not substitute a mutable cache for a candidate artifact.
✅ Do not change platform-owned actions, public mirrors, *-test-sources repositories, or reusable-workflow policy as part of this task.
✅ Prove that the consumer can be retried without repeating the expensive producer, within the agreed retention contract.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

sonarqubecloud · 2026-09-15T13:55:45Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

tomverin

Looks good — the right shape for a scanner-only Maven consumer. The deploy: false guard, restore check, and existing Sonar orchestration are all in the right places.

Left a few non-blocking nits: harden check_build_output_restored (/usr/bin/find, drop maxdepth 4), fail or warn when skip-build would do nothing, assert the restore check is actually called from build_maven, and add a short producer/consumer example in the README.

Please rebase onto master before merge — the PR is currently behind.

tomverin · 2026-09-18T07:49:48Z

+check_build_output_restored() {
+  if ! find . -mindepth 1 -maxdepth 4 -type d -path '*/target/classes' 2>/dev/null | grep -q .; then


Nit: this file already uses /usr/bin/find in export_built_artifacts so Windows runners do not pick up FIND.EXE — worth matching that here.

maxdepth 4 also misses a/b/c/target/classes (depth 5). The check is “any module”, so this only false-fails when every compiled module is deeper than 4, but the cutoff is arbitrary. Prefer /usr/bin/find … -print -quit without a depth cap.

find | grep -q under set -o pipefail is also a known GNU-find SIGPIPE hazard on Linux runners. Specs only create one target/classes, so they would not catch it.

tomverin · 2026-09-18T07:49:49Z

+  else
+    echo "Skipping Maven compile/test/deploy (skip-build enabled) - analyzing previously built output restored on disk."
+  fi


When skip-build is on and should_scan is false (short-lived branch, or sonar-platform: none), this job exits 0 having done no build and no scan. The normal action still runs mvn verify in that case.

The deploy: false guard covers the original deploy footgun; this remaining combination is now an explicit spec (skips the build output check when analysis is disabled). Prefer ::error + exit 1 here, or at least a warning, so a misconfigured scanner-only job is not silently green.

tomverin · 2026-09-18T07:49:50Z

+    Describe 'skip-build'
+      Mock check_build_output_restored
+        true
+      End


This mock means the skip-build examples never assert that build_maven actually calls check_build_output_restored. The function is unit-tested in isolation, but a regression that drops the call would still pass. Worth one example without the mock (or a spy) that expects the missing-output error when analysis is on and no target/classes exists.

tomverin · 2026-09-18T07:49:51Z

 | `artifactory-deployer-role` | Suffix for the Artifactory deployer role in Vault                                                                            | `qa-deployer` for private repos, `public-deployer` for public repos                         |
 | `deploy`                    | Whether to deploy on master, maintenance, dogfood and long-lived branches                                                    | `true`                                                                                      |
 | `deploy-pull-request`       | Whether to also deploy for pull requests. If deploy is false, this has no effect.                                            | `false`                                                                                     |
+| `skip-build`                | If `true`, skip compile/test/deploy and only run Sonar analysis against restored `target/` output. Requires `deploy: false`. | `false`                                                                                     |


A short producer/consumer example would help the first callers: upload the full target/ tree (classes and surefire/jacoco if the quality gate expects coverage), download it in the scanner job, then skip-build: true and deploy: false.

The restore check only looks for a target/classes directory — an empty dir passes, and coverage reports are not validated.

mary-georgiou · 2026-09-18T07:51:29Z

@tomverin thanks a lot! I drafted this cause we paused the sprint we are working on. I'll test it more and merge it later (later = during next week).
I'll apply your comments and reask for review. IT's a big change so I would feel more comfortable if you'd look again.

mary-georgiou requested a review from a team as a code owner September 15, 2026 13:12

hashicorp-vault-sonar-prod Bot changed the title ~~Add skip build option to maven build~~ PREQ-8698 Add skip build option to maven build Sep 15, 2026

gitar-bot Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread build-maven/build.sh

gitar-bot Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread build-maven/action.yml

gitar-bot Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread build-maven/build.sh Outdated

Add scan only mode

b2725ea

mary-georgiou force-pushed the mary/CLP-738-scan-maven branch from 7bb26d7 to b2725ea Compare September 15, 2026 13:30

tomverin approved these changes Sep 18, 2026

View reviewed changes

mary-georgiou marked this pull request as draft September 18, 2026 07:50

Navigation Menu

PREQ-8698 Add skip build option to maven build - #348

PREQ-8698 Add skip build option to maven build#348
mary-georgiou wants to merge 2 commits into
masterfrom
mary/CLP-738-scan-maven

mary-georgiou commented Sep 15, 2026 •

edited by gitar-bot Bot

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Sep 15, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot commented Sep 15, 2026

Uh oh!

sonarqubecloud Bot commented Sep 15, 2026

Uh oh!

tomverin left a comment

Uh oh!

tomverin Sep 18, 2026

Uh oh!

tomverin Sep 18, 2026

Uh oh!

tomverin Sep 18, 2026

Uh oh!

tomverin Sep 18, 2026

Uh oh!

mary-georgiou commented Sep 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		check_build_output_restored() {
		if ! find . -mindepth 1 -maxdepth 4 -type d -path '*/target/classes' 2>/dev/null \| grep -q .; then

Conversation

mary-georgiou commented Sep 15, 2026 • edited by gitar-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Gitar

Uh oh!

hashicorp-vault-sonar-prod Bot commented Sep 15, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot commented Sep 15, 2026

Uh oh!

sonarqubecloud Bot commented Sep 15, 2026

Quality Gate passed

Uh oh!

tomverin left a comment

Choose a reason for hiding this comment

Uh oh!

tomverin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

tomverin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

tomverin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

tomverin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

mary-georgiou commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mary-georgiou commented Sep 15, 2026 •

edited by gitar-bot Bot

Loading

hashicorp-vault-sonar-prod Bot commented Sep 15, 2026 •

edited by atlassian Bot

Loading

mary-georgiou commented Sep 18, 2026 •

edited

Loading