BUILD-10586 Fix inconsistencies between actions inputs, outputs and behaviors

[julien-carsique-sonarsource]

Summary

Fixes BUILD-10586 — inconsistencies between ci-github-actions inputs, outputs, deploy and scan behaviors.

Deploy input and long-lived branch deployment

• Add deploy input to build-npm, build-yarn, build-poetry (was already present in build-gradle/build-maven)
• Enable deployment on long-lived feature branches (feature/long/*) for npm/yarn/poetry (aligns with maven/gradle behavior)
• Condition Artifactory deploy token vault secret on deploy being enabled (inputs.deploy != 'false' && inputs.run-shadow-scans != 'true')

Caching input naming

• Add disable-caching input to build-npm, build-yarn, and config-npm; deprecate cache-npm/cache-yarn (aligns with poetry/gradle/maven naming convention)
• config-npm now handles the caching logic internally; build-npm passes both inputs through directly

SonarQube branch filtering in build-gradle

• Add should_scan() to build-gradle to filter SonarQube analysis by branch type — default, maintenance, PR, and long-lived branches only (was previously running on all branches when sonar-platform != none)

Idempotency guard for config-npm

• Add CONFIG_NPM_COMPLETED detection and skip to config-npm (consistent with config-gradle/config-maven): vault, npm auth, caching, version steps are skipped on second invocation within the same job

Other consistency fixes

• Align shadow scan warning to GitHub Actions ::warning stderr format across all actions
• Fix artifactory-deploy-repo description in build-npm (private repo default was incorrectly named public-qa)
• Align run-shadow-scans and deploy-pull-request descriptions across all build actions
• Fix SONAR_PLATFORM sh header description in build-yarn/build-poetry (was missing or none option)
• Rename "Required environment variables" to "Required inputs" in build-npm/build.sh header
• Update README: deployment strategy table (long-lived row, removed obsolete footnotes and known-bug note), input tables

Test plan

• All 271 shellspec tests pass with 0 failures and 0 warnings
• Pre-commit hooks pass (yamllint, shellcheck, markdownlint, trailing whitespace)
• Manual integration test on a long-lived feature branch (feature/long/*) for npm/yarn/poetry

Integration testing PRs

• sonar-dummy (maven): https://github.com/SonarSource/sonar-dummy/pull/567
• sonar-dummy-gradle-oss (gradle): BUILD-10586 Testing sonar-dummy-gradle-oss#339
• sonar-dummy-js (npm): BUILD-10586 Testing sonar-dummy-js#122
• sonar-dummy-maven-enterprise (maven enterprise): https://github.com/SonarSource/sonar-dummy-maven-enterprise/pull/128
• sonar-dummy-python-oss (poetry): BUILD-10586 Testing sonar-dummy-python-oss#96
• sonar-dummy-yarn (yarn): https://github.com/SonarSource/sonar-dummy-yarn/pull/49

[hashicorp-vault-sonar-prod]

BUILD-10586

[Copilot]

Pull request overview

This PR addresses BUILD-10586 by aligning the inputs/outputs and branch-dependent behavior across the repository’s GitHub composite actions and their underlying build scripts (npm/yarn/poetry/gradle/maven), plus documentation and shellspec coverage.

Changes:

• Add/align deploy and disable-caching inputs across actions, including updated deploy behavior on feature/long/* for npm/yarn/poetry.
• Make deploy-token retrieval conditional (deploy enabled and not shadow scanning) and standardize deployment-disabled warnings to GitHub Actions ::warning format.
• Add Gradle SonarQube branch filtering via a new should_scan() gate and expand tests/docs to match the new behavior.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
spec/build-yarn_spec.sh	Updates/extends tests for deploy input, long-lived deploy, and warning format.
spec/build-poetry_spec.sh	Updates/extends tests for deploy input, long-lived deploy, and shadow-scan deployment warning.
spec/build-npm_spec.sh	Updates/extends tests for deploy input, long-lived deploy, and warning format.
spec/build-gradle_spec.sh	Adds tests for new should_scan() logic and a dogfood no-sonar path.
promote/promote.sh	Consolidates required env var assertions and minor variable handling tweaks.
pr_cleanup/cleanup.sh	Simplifies required env var assertions and updates header comment.
config-npm/npm_set_project_version.sh	Consolidates required env var assertions.
config-npm/action.yml	Adds disable-caching input, deprecates cache-npm, and adds idempotency guard (CONFIG_NPM_COMPLETED).
config-maven/set_maven_project_version.sh	Documents SKIP behavior and consolidates required env var assertions.
config-gradle/set_gradle_project_version.sh	Documents SKIP behavior and consolidates required env var assertions.
build-yarn/build.sh	Adds DEPLOY handling, enables deploy on long-lived branches, and standardizes deployment-disabled warnings.
build-yarn/action.yml	Adds deploy/disable-caching, deprecates cache-yarn, and conditions deploy token retrieval.
build-poetry/build.sh	Adds DEPLOY handling, enables deploy on long-lived branches, and standardizes deployment-disabled warnings.
build-poetry/action.yml	Adds deploy and conditions deploy token retrieval.
build-npm/build.sh	Adds DEPLOY handling, enables deploy on long-lived branches, and standardizes deployment-disabled warnings.
build-npm/action.yml	Adds deploy/disable-caching, deprecates cache-npm, and conditions deploy token retrieval.
build-maven/build.sh	Refactors env var assertions/exports and minor should_scan conditional style change.
build-gradle/build.sh	Adds should_scan() and uses it to gate sonar orchestration by branch type.
build-gradle/action.yml	Updates run-shadow-scans description text to match other actions.
README.md	Updates inputs tables and the deploy/scan behavior matrix for new inputs/behaviors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[bwalsh434]

This is huge! LGTM!

I've had great success with telling Claude to open PRs in all of the dummy repos to test the changes to the actions, so I highly rec you do that here as well if you haven't.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[sonarqubecloud]

SonarQube reviewer guide

Summary: Update CI/CD build actions to support shadow scans, enable deployment on long-lived branches, add deploy input parameter, and deprecate caching parameters in favor of disable-caching.

Review Focus:

• The deploy input parameter is now available across all build actions (npm, yarn, poetry, maven, gradle) to override deployment behavior. Verify the logic correctly disables deployment when deploy: false while respecting branch-based decisions.
• Shadow scans now properly suppress deployment to prevent duplicate artifacts, with credentials fetched when run-shadow-scans: true.
• Long-lived feature branches (feature/long/*) now deploy by default (previously didn't for npm/yarn/poetry). Ensure this aligns with deployment policy.
• Deprecation of cache-npm and cache-yarn in favor of disable-caching requires careful migration path validation.

Start review at: build-npm/action.yml and build-npm/build.sh. These files contain the core pattern changes (deploy input, shadow scans credential logic, long-lived branch deployment, caching deprecation) that are replicated across all other build actions. Understanding the npm implementation first provides a template for validating consistency across maven, gradle, yarn, and poetry variants.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud