ci: cache SonarScanner CLI to avoid flaky CDN download - #1874
Closed
firecow wants to merge 2 commits into
Closed
Conversation
The SonarQube scan runs as the final step of the test job and intermittently returns HTTP 403 while downloading the scanner CLI from binaries.sonarsource.com, failing the whole build even though tests passed. It is a reporting step and the quality gate is reported via its own check, so mark it continue-on-error.
The scan action downloads the scanner CLI from binaries.sonarsource.com on every run, which intermittently returns HTTP 403 and fails the build. The action checks the tool-cache first (tc.find) and only downloads on a miss, so persisting that directory with actions/cache makes every run after the first restore the scanner and skip the CDN entirely. scannerVersion is pinned to keep the cache key in sync.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SonarQube scan action downloads the scanner CLI from
binaries.sonarsource.comon every run, which intermittently returns HTTP 403 and fails themasterbuild even though tests pass (a known SonarSource CDN issue).The action checks the GitHub Actions tool-cache first (
tc.find) and only downloads on a miss, so persisting that directory withactions/cachemakes every run after the first restore the scanner and skip the CDN entirely — the scan still runs, nothing is suppressed.scannerVersionis pinned so the cache key invalidates on a version bump.Residual: a cold cache (first run / scanner version bump) still hits the CDN once; if that transiently 403s, a single re-run seeds the cache permanently.
Test plan
continue-on-errornot used; cache key matches pinnedscannerVersionSummary by cubic
Cache the SonarScanner CLI in CI to avoid intermittent CDN 403s and keep builds stable. Restores the scanner from
actions/cacheand pinsscannerVersion: 8.1.0.6389, so after the first run the CDN is skipped; the cache is only used whenSONAR_TOKENis set.Written for commit 637a89a. Summary will update on new commits.