MWPW-00000: Foo

[sanrai]

Bar

[github-actions]

AI Code Review

Last updated Aug 19, 2026 6:39 PM PDT · PR opened · commit e8e7f2d · 4 files changed in PR.

1 open · 0 resolved · this run: +1 new

Open findings

• 🔴 SonarQube job runs untrusted PR code on self-hosted runner with secrets 🆕
  In pull-request.yaml, the new sonarqube job runs on [self-hosted, macos-qa] and is triggered by pull_request events, checking out attacker-controlled code while exposing SONAR_TOKEN/SONAR_HOST_URL secrets; a malicious fork PR could exfiltrate secrets or execute arbitrary code on the self-hosted runner.

Review history (1 run)

• e8e7f2d · Aug 19, 2026 6:39 PM PDT · PR opened · +1 new (1 open) — MWPW-00000: Foo

[github-actions]

Agent QA review — interactive + visual diff (advisory, non-blocking)

Last updated Aug 19, 2026, 6:42 PM PDT · PR opened · commit e8e7f2d · 4 files changed.

0 open · 0 resolved · visual diff 0.00% · verdict PASS

Open findings

• Smoke test passed ✅

What the agent checked

Tested PR #586 (title "MWPW-00000: Foo", desc "Bar") against the live business.adobe.com/resources/main.html CaaS collection.

Context: The code diff for this PR touches ONLY CI/tooling files (.github/qa/FOO.md, .github/workflows/merge.yaml, .github/workflows/pull-request.yaml, sonar-project.properties) — i.e. GitHub Actions workflow changes (adding a SonarQube coverage job) and a placeholder markdown file. There is no React/JS/CSS source change in the diff, which matches the captured pixel-diff report showing 0.00% of pixels changed between PR and stable builds. Loading the diff.png confirmed there were no magenta/highlighted regions at all — a blank/no-diff image — consistent with a CI-only change that has zero effect on rendering.

Manual QA performed on the live page to confirm no regression:

1. Page loads correctly: header nav, breadcrumb (Home / Resource Center), "Explore all Adobe resources" heading, results count (3834 results), sort-by control, and the CaaS card grid all render normally with no visual glitches, overlap, or truncation.
2. Left filters panel (Refine Your Results) renders correctly with Clear button, Search box, and Products/Content Type/Industry accordion filters — matches the region highlighted as containing the LeftFilters testid.
3. Typed "creative" into the filter search box and pressed Enter — the results count and card grid did not update/filter (remained at "3834 results" showing the same two lead cards). This appears to be pre-existing search behavior on the live site, not something introduced by this PR, since the PR contains no functional code changes to the CaaS search/filter logic. Flagging it here for visibility, but it is out of scope for this PR's diff.
4. Console errors: only a benign "Permissions policy violation: unload is not allowed in this document" message, unrelated to the PR and commonly seen on this domain due to embedded chat/analytics scripts.
5. Did not detect any layout breakage, low-contrast, or missing elements attributable to this PR.

Conclusion: This PR is a CI/DevOps-only change (adds a SonarQube coverage-analysis job to merge/pull-request workflows and an internal FOO.md doc + sonar-project.properties config). It does not touch any frontend source code, and the 0.00% pixel diff plus empty diff overlay confirm no rendering impact. The live page functions and displays normally with this build injected. The one behavioral oddity noticed (search input not filtering results on Enter) is a pre-existing site behavior unrelated to this PR's scope and not a regression introduced by it.

Verdict: PASS — safe, no-op change from a frontend/rendering perspective; no regressions introduced by this PR.

PR / stable / diff screenshots + console + axe artifacts in the workflow run.

Review history (1 run)

• e8e7f2d · Aug 19, 2026, 6:42 PM PDT · PR opened · passing, no regressions — MWPW-00000: Foo

[sonarqube-acom-pr-deco-public]

Quality Gate failed

• 77.70% Coverage on New Code (is less than 80.00%)
• 5.40% Duplicated Lines (%) on New Code (is greater than 3.00%)
• 0.00% Security Hotspots Reviewed on New Code (is less than 100.00%)
• 359 New Issues (is greater than 0)

Project ID: adobecom_caas_9e89bc21-de4f-46e2-9443-2052ced9386d

View in SonarQube

[github-actions]

🧪 Feature QA review — injected feature test (advisory, non-blocking)

Last updated Aug 19, 2026, 6:43 PM PT · commit 5adeb86 · pull_request.

Overall: SKIPPED

Not an injectable feature -- skipped.

This PR only adds CI/CD workflow and SonarQube configuration changes, with no product feature or config/card-data-driven UI behavior to exercise.

This PR's change isn't driven by config/collection data the harness can force, and the build-output-diff verdict wasn't available to consult. (The visual/smoke review still applies.)

Screenshot in the workflow run.

Review history (1 run)

• Aug 19, 2026, 6:43 PM PT · SKIPPED · 5adeb86 · pull_request