From 1b9663a6f044951e844f973ff675febfea97fa2b Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 9 Sep 2026 00:09:26 +0100
Subject: [PATCH] chore(ci): remove duplicate self-run SonarQube workflow

cicd-squabbler runs Sonar analysis twice. The SonarCloud App
(app=sonarqubecloud) emits the required `SonarCloud Code Analysis`
context and is green. This workflow additionally runs
SonarSource/sonarqube-scan-action itself, emitting a separate
`SonarQube` check (app=github-actions) that is red on every push.

Measured on main HEAD be78284:
  failure  SonarQube                    app=github-actions   <- this file
  success  SonarCloud Code Analysis     app=sonarqubecloud   <- the App

The two are different apps, so removing this workflow cannot take the
required App check with it. `SonarQube` is not a required context on
ruleset 18261844 (required: CodeQL, openssf-compliance, SonarCloud Code
Analysis), so nothing turns absent.

`sonarqube.yml` is listed under `never_required_workflows` in
standards/config/rulesets/gates.json, so deletion is consistent with
estate policy. sonar-project.properties is retained -- automatic
analysis still reads its scope and exclusions. The repo has no
actions.lock, so there is no pin entry to keep in sync.

Net effect: one less wasted runner per push, and one less permanently
red check on the board.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TCKh98NmUmfvgpuGyJbNu8
---
 .github/workflows/sonarqube.yml | 33 ---------------------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 .github/workflows/sonarqube.yml

diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
deleted file mode 100644
index 3690484..0000000
--- a/.github/workflows/sonarqube.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# SonarQube Cloud (SonarCloud) static analysis. Analysis scope + exclusions live
-# in sonar-project.properties. Requires the SONAR_TOKEN repository secret
-# (Settings -> Secrets and variables -> Actions) and a SonarCloud project:
-# https://sonarcloud.io/project/overview?id=hyperpolymath_rsr-template-repo
-# Mirrors the boj-server arrangement.
-name: SonarQube
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  actions: read
-  contents: read
-jobs:
-  sonarqube:
-    name: SonarQube
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0   # full history for accurate new-code detection
-      - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}