From 171e08372674e1b441f2675de5fc30b49e6964cb Mon Sep 17 00:00:00 2001
From: skudasov <f4hrenh9it@gmail.com>
Date: Sun, 25 Oct 2026 14:21:24 +0100
Subject: [PATCH] In scope of
 https://smartcontract-it.atlassian.net/browse/DX-5526 we are sunsetting
 SonarQube.

Removing the jobs that run sonarsource/sonarqube-scan-action or the shared
smartcontractkit/.github ci-sonarqube-go / ci-sonarqube-ts actions.

The SonarScanner CLI downloaded by these actions bundles a Java runtime that
still trusts the compromised eMudhra roots, and no fixed release is
available yet:
- https://github.com/SonarSource/sonarqube-scan-action/pull/287
- https://github.com/SonarSource/sonar-scanner-cli/pull/312
---
 .github/workflows/sonar-scan.yml | 79 --------------------------------
 1 file changed, 79 deletions(-)
 delete mode 100644 .github/workflows/sonar-scan.yml

diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
deleted file mode 100644
index 94ea211..0000000
--- a/.github/workflows/sonar-scan.yml
+++ /dev/null
@@ -1,79 +0,0 @@
-name: SonarQube Scan
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  wait_for_workflows:
-    name: Wait for workflows
-    runs-on: ubuntu-latest
-    if: always()
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
-
-      - name: Wait for workflows
-        uses: smartcontractkit/chainlink-github-actions/utils/wait-for-workflows@e29366cdecfe6befff9ab8c3cfe4825218505d58 # v2.3.16
-        with:
-          max-timeout: "900"
-          polling-interval: "30"
-          exclude-workflow-names: "CD Release, Dependency Vulnerability Check"
-          exclude-workflow-ids: ""
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-        env:
-          DEBUG: "true"
-
-  sonarqube:
-    name: SonarQube Scan
-    needs: [wait_for_workflows]
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-    if: always()
-    steps:
-      - name: Checkout the repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # fetches all history for all tags and branches to provide more metadata for sonar reports
-
-      - name: Download Golangci-lint report
-        if: always()
-        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
-        with:
-          workflow: ci-lint.yml
-          name: golangci-lint-report
-          workflow_conclusion: ""
-          if_no_artifact_found: warn
-
-      - name: Download go unit test coverage reports
-        if: always()
-        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
-        with:
-          workflow: ci-test.yml
-          name: go-test-results
-          workflow_conclusion: ""
-          if_no_artifact_found: warn
-
-      - name: Set SonarQube Report Paths
-        if: always()
-        id: sonarqube_report_paths
-        shell: bash
-        run: |
-          echo "sonarqube_go_coverage_report_paths=$(find -type f -name '*coverage.txt' -printf '%p,')" >> $GITHUB_OUTPUT
-          echo "sonarqube_golangci_report_paths=$(find -type f -name 'golangci-lint-report.xml' -printf '%p,')" >> $GITHUB_OUTPUT
-
-      - name: SonarQube Scan
-        if: always()
-        uses: sonarsource/sonarqube-scan-action@53c3e3207fe4b8d52e2f1ac9d6eb1d2506f626c0 # v2.0.2
-        with:
-          args: >
-            -Dsonar.go.coverage.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_go_coverage_report_paths }}
-            -Dsonar.go.golangci-lint.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_golangci_report_paths }}
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}