From 5eea87e144d7a5b89b7bea891bc1f14068e2ed4b Mon Sep 17 00:00:00 2001
From: skudasov <f4hrenh9it@gmail.com>
Date: Sun, 25 Oct 2026 14:18:15 +0100
Subject: [PATCH] In scope of
 https://smartcontract-it.atlassian.net/browse/DX-5526 we are sunsetting
 SonarQube.

Removing the jobs that run sonarsource/sonarqube-scan-action or the shared
smartcontractkit/.github ci-sonarqube-go / ci-sonarqube-ts actions.

The SonarScanner CLI downloaded by these actions bundles a Java runtime that
still trusts the compromised eMudhra roots, and no fixed release is
available yet:
- https://github.com/SonarSource/sonarqube-scan-action/pull/287
- https://github.com/SonarSource/sonar-scanner-cli/pull/312
---
 .github/workflows/sonar-scan.yml | 89 --------------------------------
 1 file changed, 89 deletions(-)
 delete mode 100644 .github/workflows/sonar-scan.yml

diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
deleted file mode 100644
index 2f80acfd45..0000000000
--- a/.github/workflows/sonar-scan.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: SonarQube Scan
-
-on: [push]
-
-# Reading other workflows' runs and artifacts takes actions: read.
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  wait_for_workflows:
-    name: Wait for workflows
-    runs-on: ubuntu-latest
-    if: always()
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
-
-      - name: Wait for workflows
-        uses: smartcontractkit/.github/actions/wait-for-workflows@dca9ab89d734e82738b8aa52bd25d09b205ec6ee # v0.1.1
-        with:
-          max-timeout: "1200"
-          polling-interval: "30"
-          exclude-workflow-names: "Build External Repositories, Observability Lib Checks, Run Benchmarks, LLM Action Error Reporter"
-          exclude-workflow-ids: ""
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-        env:
-          DEBUG: "true"
-
-  sonarqube:
-    name: SonarQube Scan
-    needs: [wait_for_workflows]
-    runs-on: ubuntu-latest
-    if: always()
-    # The steps of smartcontractkit/.github's ci-sonarqube-go, pinned to this commit's reports. That
-    # action takes the newest artifact of one fixed name from any branch, and lint artifacts here
-    # are named per module.
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Download coverage reports
-        uses: dawidd6/action-download-artifact@634d83b91986fcec9be314054943fa5c976aeb0e # v25
-        with:
-          workflow: pkg.yml
-          name: go-test-coverage-.*
-          name_is_regexp: true
-          commit: ${{ github.sha }}
-          search_artifacts: true
-          workflow_conclusion: ""
-          # Every push to main has its reports; a push elsewhere has them only if it is a pull request's.
-          if_no_artifact_found: ${{ github.ref_name == 'main' && 'fail' || 'warn' }}
-          path: sonar-reports/coverage
-
-      - name: Download lint reports
-        uses: dawidd6/action-download-artifact@634d83b91986fcec9be314054943fa5c976aeb0e # v25
-        with:
-          workflow: golangci_lint.yml
-          name: golangci-lint-report-.*
-          name_is_regexp: true
-          commit: ${{ github.sha }}
-          search_artifacts: true
-          workflow_conclusion: ""
-          # Every push to main has its reports; a push elsewhere has them only if it is a pull request's.
-          if_no_artifact_found: ${{ github.ref_name == 'main' && 'fail' || 'warn' }}
-          path: sonar-reports/lint
-
-      - name: Set SonarQube Report Paths
-        # Lint runs only when Go files change, so a commit may have no reports to pass.
-        run: |
-          mkdir -p sonar-reports
-          coverage=$(find sonar-reports -type f -name coverage.txt -printf "%p,")
-          lint=$(find sonar-reports -type f -name golangci-lint-report.xml -printf "%p,")
-          args=""
-          [[ -n "$coverage" ]] && args="$args -Dsonar.go.coverage.reportPaths=$coverage"
-          [[ -n "$lint" ]] && args="$args -Dsonar.go.golangci-lint.reportPaths=$lint"
-          echo "SONARQUBE_ARGS=$args" >> "$GITHUB_ENV"
-
-      - name: SonarQube Scan
-        uses: sonarsource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
-        with:
-          args: ${{ env.SONARQUBE_ARGS }}
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}