ci: cache SonarScanner CLI to avoid flaky CDN download

The scan action downloads the scanner CLI from binaries.sonarsource.com on
every run, which intermittently returns HTTP 403 and fails the build. The
action checks the tool-cache first (tc.find) and only downloads on a miss, so
persisting that directory with actions/cache makes every run after the first
restore the scanner and skip the CDN entirely. scannerVersion is pinned to keep
the cache key in sync.

Author: firecow

.github/workflows/build.yml

@@ -83,9 +83,19 @@ jobs:
       - run: bun install --frozen-lockfile
       - name: Run Tests
         run: bun run coverage
+      # Persist the scanner CLI across runs so the action restores it from cache
+      # (tc.find short-circuits the download) instead of fetching it from the
+      # intermittently-403ing binaries.sonarsource.com on every run.
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        if: ${{ env.SONAR_TOKEN != '' }}
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          path: ${{ runner.tool_cache }}/sonar-scanner-cli
+          key: sonar-scanner-cli-${{ runner.os }}-${{ runner.arch }}-8.1.0.6389
       - uses: sonarsource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1
-        # Reporting only; a transient scanner-download 403 must not fail the build. The quality gate is reported via its own check.
-        continue-on-error: true
+        with:
+          scannerVersion: 8.1.0.6389
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}