fix(gates): SonarCloud is an external app check, not a governance advisory job

[hyperpolymath]

What

One entry removed from never_required_contexts in config/rulesets/gates.json.

     "CodeQL (default setup)",
-    "Live Actions policy (credentialed advisory)",
-    "SonarCloud Code Analysis"
+    "Live Actions policy (credentialed advisory)"
   ]

Why: the list was being used for two different jobs

never_required_match in this same file defines the semantics as a subtraction from the derived set:

an entry in never_required_contexts matches either the whole context or the part after the first " / " (the reusable job name); it is removed from the derived set, never typed

And tests/test_governance_reusable_shape.sh states the list's actual purpose (check 6):

Every advisory job name is excluded from ruleset derivation via config/rulesets/gates.json never_required_contexts.

It then asserts exactly three names — Live Actions policy (credentialed advisory), Code quality + docs, Allowlist Preflight. Those are governance-reusable's own continue-on-error: true jobs. All three are untouched by this PR and the guard test still passes.

SonarCloud Code Analysis is not one of them. It is emitted by the sonarqubecloud GitHub App, not by any job in this repository. It has no continue-on-error to exempt and no job name to subtract. It was in an advisory-job exclusion list because it looked like a context to exclude, not because it is an advisory job.

This repo's own tooling already says so

scripts/check-gate-tiers.sh classifies exactly this case, and reaches the opposite conclusion to the gates.json line:

EXTERNAL_REQUIRED — required context emitted by a GitHub App rather than a workflow in this repo (CodeQL default setup, SonarCloud, …). Printed for visibility, NOT counted: it is outside the tier system, not a breach of it.

So the tier lint and the derivation policy disagreed with each other about the same class of context. This PR makes the policy agree with the lint.

The measured contradiction

76 repos require SonarCloud Code Analysis. On those repos the context is emitted and green — it is a working gate doing real work. Because never_required_match subtracts, the policy line meant the derivation could never reproduce production: it would have stripped a live, passing, deliberately-required gate from all 76.

Two ways to resolve that. Either edit 76 rulesets to match the policy, or edit one policy file to match the 76 rulesets. Owner ruling: fix the policy. When live configuration and written policy disagree at a scale of 76 repos, the policy is the thing more likely to be wrong — and here nothing is failing, so there is no defect to preserve.

⚠ Still open: Code quality + docs resolves the OTHER way

Not fixed here, and deliberately so. 45 repo/context pairs require Code quality + docs, which is one of the three genuine advisory jobs — continue-on-error: true, and the guard test requires its presence in this list. Removing it would break test_governance_reusable_shape.sh and would promote a job that is allowed to fail into a blocking gate.

So this is the same shape of contradiction with the opposite cure: for SonarCloud the policy was wrong; for Code quality + docs the 45 rulesets are wrong. That is a ruleset campaign, not a one-line change, and it needs its own decision. Flagged rather than folded in, so the ruling given for SonarCloud is not silently generalised to a case it does not fit.

Verification

• jq empty — valid JSON.
• Diff is 3 lines: the entry removed, plus the trailing comma on the preceding line.
• All three names asserted by check 6 of tests/test_governance_reusable_shape.sh verified still present.
• Branched from main at 8f2ee508 and committed via the API, so no local working tree is involved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TCKh98NmUmfvgpuGyJbNu8

[coderabbitai]

Warning

Review limit reached

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ee58a9ad-c959-4f86-9eb6-fb11e4dadc61

📥 Commits

Reviewing files that changed from the base of the PR and between 619713b and 7a6f872.

📒 Files selected for processing (1)

• config/rulesets/gates.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud