[aurelien-poscia-sonarsource]

Summary

SC-60373, part of SC-50795.

Pilot of SonarSource/ci-github-actions#363: build-poetry authenticates SonarQube Cloud scans (sqc-eu, sqc-us) with the GitHub OIDC token (WIF) instead of the sonarcloud and sonarqube-us Vault tokens.

Both build-poetry@master usages point to feature/ap/SC-60373-wif-sonarqube-cloud-scans:

• build.yml: Build job (single-platform scan, sonar-platform: sqc-eu, already set on master).
• unified-dogfooding.yml: run-shadow-scans: true (EU and US auth steps). A temporary pull_request: trigger is added so it runs on this PR.

Nothing is left on the default next platform for single-platform scans: build-poetry is only used in these two places, and the shadow scan step does not use sonar-platform.

Do not merge. Close this PR once the pilot is done.

What to check

• The repository is bound to project SonarSource_sonar-dummy-python-oss on both EU and US, with trusted scanning enabled.
• The EU and US auth steps succeed (token exchange, no binding or trusted scanning error).
• The scans are uploaded to the bound project.
• run-iris and the Next scan still read their tokens from Vault.

Test plan

• Build workflow passes
• Unified Dogfooding scans passes on this PR (EU and US)

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SC-60373

[gitar-bot]

CI failed: Both CI job logs (build-poetry and build workflows) are truncated before any failing step appears; all visible setup, WIF/auth-related, and cache steps succeed, so the actual failure is unidentified and its relation to the PR is unclear.

Overview

Two unique error templates were analyzed from 2 logs (jobs 120499156583 and 120499154126). Neither log contains an identifiable failing step, exit code, or error message; both excerpts end during setup/cleanup, so no change-related failure can be confirmed.

Failures

Unidentified failure in truncated job logs (confidence: low)

• Type: other
• Affected jobs: 120499156583, 120499154126
• Related to change: unclear
• Root cause: The supplied excerpts show only successful steps (step-security, mise setup, build number retrieval, S3/GitHub cache probing, Artifactory role/env setup) followed by runner cleanup. The agent-service "Protection failed ... no such file or directory" lines and the /etc/docker/daemon.json report are not tied to a failed workflow step and do not establish a CI failure. The PR (WIF authentication pilot in build-poetry) is not shown to be the cause.
• Suggested fix: Retrieve the complete job logs and job conclusions, identify the first failed step and its error output. If the failing step is authentication-related, verify the workload identity provider configuration, token permissions (id-token: write), and role bindings for the Artifactory reader/deployer roles. Otherwise, address the error reported by that step.

Summary

• Change-related failures: None confirmed; both findings are marked unclear.
• Infrastructure/flaky failures: None identified.
• Recommended action: Provide or open the full logs for jobs 120499156583 and 120499154126 to locate the actual failing step before assessing whether the WIF change is responsible.

Code Review ✅ Approved

🔴 High risk · PR-triggered scans now use a WIF-enabled action branch; misconfigured federation could authorize scans under an unintended identity.

Switches build-poetry SonarQube Cloud scans (sqc-eu, sqc-us) to GitHub OIDC workload identity federation instead of Vault tokens, and points both build.yml and unified-dogfooding.yml at the pilot branch. No issues found.

Verification Rules 3/3 met PRs 1 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners (approved_runners)
✅ Internal artifact registries (artifactory_registries)
✅ Repository license compliance (license_compliance)

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 363: SC-60373 Use WIF to authenticate SonarQube Cloud scans in build actions Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}