[Fleet Monitor] petry-projects/TalkTerm — .github/workflows/sonarcloud.yml

[don-petry]

🟡 WARNING: petry-projects/TalkTerm / .github/workflows/sonarcloud.yml

Metric	Value
Failure Rate	12.5% (1 / 8 runs)
Status	WARNING
p50 Duration	40s
p95 Duration	291s
Successful Runs	7
Cancelled Runs	0

Workflow: .github/workflows/sonarcloud.yml

Last updated by Fleet Monitor run on 2026-07-23.
Threshold: failure rate > 10% over the monitored window.

[don-petry]

Dev-Lead Implementation Plan

Issue: #406 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/sonarcloud.yml

Root-cause analysis

The 2 "failures" in the monitored 8-run window are both action_required runs on the now-inactive dev-lead/issue-349 bot branch. They are born-terminal (created_at == updated_at, zero jobs) — GitHub finalizes them as action_required before any job or concurrency evaluation, so cancel-in-progress can never cancel them. fleet_monitor.sh:140 deliberately counts action_required as a failure. Zero such runs exist in the last 60 runs across all workflows, so the metric is already self-healing.

The prior fix (#403) added a concurrency: block whose comment claims it dedupes these action_required siblings. That premise is false (born-terminal runs are uncancellable), and the block is unsanctioned drift: template_stub_drift.sh enforces sonarcloud.yml as byte-identical to the org canonical template (only ci.yml is allowlisted). The repo's copy has drifted from canonical — missing the SOURCE-OF-TRUTH header and the hardening "Set up JDK 21" step, carrying older action SHAs (checkout v6.0.3 vs v7.0.0, scan v8.2.1 vs v8.2.0), plus the ineffective concurrency block.

Scope

Restore .github/workflows/sonarcloud.yml to the org canonical template (de-drift), removing the ineffective/unsanctioned concurrency block and adopting the org's reliability-hardened version.

Implementation Checklist

• Replace .github/workflows/sonarcloud.yml with the byte-identical output of seed-repo-template.sh --emit-workflow sonarcloud.yml

Tests to Write

• Verification (red→green): diff <(bash .dev-lead/scripts/seed-repo-template.sh --emit-workflow sonarcloud.yml) .github/workflows/sonarcloud.yml — currently DRIFTED, must become IDENTICAL after the change. (No unit-test harness applies to a workflow YAML; per Phase 2 exception this is a config/de-drift change.)

Test Command

diff <(bash .dev-lead/scripts/seed-repo-template.sh --emit-workflow sonarcloud.yml) .github/workflows/sonarcloud.yml && echo IDENTICAL

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Root-caused the flakiness: 2 born-terminal action_required runs on the inactive dev-lead/issue-349 bot branch (0 jobs, created_at == updated_at) that concurrency/cancel-in-progress cannot cancel and fleet_monitor.sh:140 counts as failures
• Found the file was drifted from the byte-identity-enforced org template (template_stub_drift.sh:51)
• Restored .github/workflows/sonarcloud.yml to the canonical template (byte-identical)

Test Results

# RED (before): drift check
$ diff <(seed-repo-template.sh --emit-workflow sonarcloud.yml) .github/workflows/sonarcloud.yml
DRIFTED (expected red)

# GREEN (after): drift check
IDENTICAL (green)

# YAML validity
YAML OK

# Required repo lint (.dev-lead/scripts/dev-lead-lint.sh)
  [lint] shellcheck on 5 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

Files Changed

• .github/workflows/sonarcloud.yml: de-drifted to the org canonical template. Removed the ineffective/unsanctioned concurrency: block added in feat: implement issue #401 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/sonarcloud.yml #403 (its premise — cancelling action_required siblings — is false: born-terminal runs are finalized before any concurrency evaluation). Adopted the canonical SOURCE-OF-TRUTH header, the reliability-hardening "Set up JDK 21" step, and canonical action pins (checkout v7.0.0, setup-java v5.2.0, sonarqube-scan-action v8.2.0). The required status-check job name SonarCloud is unchanged.

Notes

• Phase 2 exception: this is a config/de-drift change to a workflow YAML with no unit-test harness; verification is the byte-identity drift check (red → green) plus YAML parse and repo lint.
• The action_required failures are a GitHub platform artifact on GITHUB_TOKEN-attributed bot-PR events (approval-gated, born terminal). They are not preventable from sonarcloud.yml and are already self-healing — 0 occurrences in the last 60 runs across all workflows; the 2 stale runs will age out of the monitor's window.
• Follow-up recommendation (out of scope here): the durable fix for the false-positive class is monitor-side — treat action_required distinctly from real failure/timed_out in fleet_monitor.sh:140, and/or adjust the repo Actions "require approval for bot PR runs" setting. Worth an org-standards issue.

[don-petry]

✅ Auto-resolved by Fleet Monitor. This workflow's failure rate has been below the 10% threshold (or the workflow was removed) since 2026-07-23 (3 days) — the monitor stopped flagging it. Closing. It will reopen automatically if the workflow crosses the threshold again.