[Fleet Monitor] petry-projects/.github — sonarcloud.yml

[don-petry]

🟠 DEGRADED: petry-projects/.github / sonarcloud.yml

Metric	Value
Failure Rate	50% (1 / 2 runs)
Status	DEGRADED
p50 Duration	44s
p95 Duration	44s
Successful Runs	1
Cancelled Runs	0

Workflow: sonarcloud.yml

Last updated by Fleet Monitor run on 2026-06-05.
Threshold: failure rate > 10% over the monitored window.

[don-petry]

Dev-Lead Implementation Plan

Issue: #391 — [Fleet Monitor] petry-projects/.github — sonarcloud.yml

Root Cause

The single failed run (26949896305, 2026-06-04) failed in the SonarCloud Scan step with:

Action failed: Unexpected HTTP response: 403

while downloading the SonarScanner CLI from binaries.sonarsource.com. This is a transient CDN-side error from the SonarSource distribution host — not a problem with the workflow logic, action SHA, secrets, or runner.

Out of the trailing 200 runs of sonarcloud.yml, only this one failed. The Fleet Monitor's small monitoring window (2 runs) magnified one transient external failure into a 50% failure rate. The fix is to make the scan tolerant of such transient external failures with a one-shot retry, so a single CDN blip no longer fails the job.

Scope

Add a single in-place retry to the SonarCloud Scan step in .github/workflows/sonarcloud.yml, then document the retry pattern in standards/ci-standards.md (§3 SonarCloud Analysis) so adopting repos pick up the same resilience.

Implementation Checklist

• .github/workflows/sonarcloud.yml — give the scan step id: sonar + continue-on-error: true, and add a second SonarCloud Scan (retry) step that runs only when steps.sonar.outcome == 'failure', reusing the same pinned SHA
• standards/ci-standards.md — update the §3 SonarCloud Analysis YAML example to include the same retry pattern so the standard stays in sync with the in-repo workflow

Tests to Write

This is a configuration-only change to a workflow that consists entirely of uses: action steps (no shell logic). The repository has no precedent for unit-testing workflow YAML structure — workflow files are validated by yamllint and actionlint in ci.yml. Per Phase 2 guidance, this falls under the "pure configuration" exception:

• Run yamllint on the updated workflow
• Run actionlint on the updated workflow
• Run bash .dev-lead/scripts/dev-lead-lint.sh

The retry semantics themselves cannot be deterministically exercised without inducing a SonarSource 403, which we cannot reproduce in CI. The Phase 2 TDD exception will be noted in the Phase 6 report.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh (+ yamllint and actionlint as available)