ci(mwpw-00000): skip SonarQube analysis for Dependabot PRs

[sanrai]

What

Skip the sonarqube job on Dependabot PRs, matching the existing skips on check-pr-title and run-bulk-publisher-e2e.

Why

SonarQube analysis was added to the PR workflow in #584. Dependabot PRs that have since been rebased onto latest main pick up the job and fail it:

SONAR_HOST_URL:
ERROR Failed to query server version: Expected URL scheme 'http' or 'https' but no scheme was found for /api/v...

The job reads ${{ secrets.SONAR_TOKEN }} and ${{ secrets.SONAR_HOST_URL }}. GitHub withholds repository secrets from Dependabot-triggered workflow runs, so both resolve to empty strings and the scanner exits 1.

Two reasons to skip rather than plumb the secrets through:

1. A dependency bump only touches package.json and package-lock.json. There is no first-party source for Sonar to analyse, so the scan has no value on these PRs.
2. Exposing the Sonar token to Dependabot-triggered runs widens the blast radius of a compromised dependency for no benefit.

This is the same reasoning already recorded on run-bulk-publisher-e2e: "Skip for Dependabot PRs — secrets are withheld by GitHub for Dependabot-triggered workflows."

Scope

• Nothing declares needs: sonarqube, so skipping it blocks no downstream job.
• The merge.yaml Sonar analysis on main is untouched — every dependency change is still analysed once it lands.
• Non-Dependabot PRs are unaffected.

Affected PRs

#591, #592, #593, #594, #595 are all currently red on this check only. Their review-score-gate already auto-passes via the deps-dev + build-output-diff NO_CHANGE fast path.

Note

Raised under mwpw-00000 as the PR-title linter requires a ticket scope — swap in a real ticket if you have one.

[github-actions]

AI Code Review

Last updated Aug 26, 2026 11:17 PM PDT · PR opened · commit 89c5336 · 1 file changed in PR.

0 open · 0 resolved

Open findings

No open findings. ✅

Review history (1 run)

• 89c5336 · Aug 26, 2026 11:17 PM PDT · PR opened · no changes (0 open) — ci(mwpw-00000): skip SonarQube analysis for Dependabot PRs

[sonarqube-acom-pr-deco-public]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (91.00% Estimated after merge)
• No data about duplications (5.40% Estimated after merge)

Project ID: adobecom_caas_9e89bc21-de4f-46e2-9443-2052ced9386d

View in SonarQube

[github-actions]

Agent QA review — interactive + visual diff (advisory, non-blocking)

Last updated Aug 26, 2026, 11:22 PM PDT · PR opened · commit 89c5336 · 1 file changed.

0 open · 0 resolved · visual diff 0.00% · verdict PASS

Open findings

• Smoke test passed ✅

What the agent checked

Tested https://business.adobe.com/resources/main.html with the PR #601 CaaS build injected.

Context: PR #601 is a pure CI workflow change (skips the SonarQube job for Dependabot PRs in .github/workflows/pull-request.yaml). It contains no frontend/CaaS code changes, which matches the provided pixel-diff result of 0.00% changed pixels. I loaded the diff.png as instructed and it showed no magenta/highlighted regions — consistent with a CI-only change that cannot affect page rendering.

Manual verification performed on the live page anyway:

• Page loads cleanly: header nav, breadcrumb (Home / Resource Center), "Explore all Adobe resources" heading, and "3844 results" counter all render correctly.
• Cards grid (consonant-CardsGrid) renders a healthy two-column grid of resource cards with images, titles, descriptions, and CTA buttons (Read now / Watch now / Read article / View event) all properly aligned, no overlapping text or broken images observed while scrolling through multiple cards.
• Left filter panel (consonant-LeftFilters) works as expected: "Refine Your Results" header, Search box with clear button, and three collapsible filter groups (Products, Content Type, Industry). Clicking "Products" expanded a checkbox list (Acrobat, Acrobat Sign, Advertising, Analytics, Brand Visibility, Campaign, Commerce, Creative Cloud, Customer Journey Analytics, Forms, etc.) with correct indentation/spacing and a scroll caret change (chevron flipped up) — no visual regressions.
• Clicking a checkbox (Acrobat, via direct DOM click since the interactive-walker didn't expose per-checkbox refs) triggered the filter without console errors.
• The floating "What do you need help solving today?" chat prompt bar at the bottom rendered consistently across all states and did not overlap or clip any card content beyond its own bar area.
• No JavaScript console errors were observed during navigation or filter interaction.

Since the code change is CI-only (workflow YAML), there is no plausible mechanism for it to alter the rendered page, and the observed 0.00% pixel diff plus my manual pass through search/filter/grid/pagination areas confirms the live resource center page is unaffected and functioning normally.

Verdict: PASS — no regressions found; PR is safe to merge from a frontend/QA perspective (it only affects CI job execution, not the shipped CaaS bundle behavior).

PR / stable / diff screenshots + console + axe artifacts in the workflow run.

Review history (1 run)

• 89c5336 · Aug 26, 2026, 11:22 PM PDT · PR opened · passing, no regressions — ci(mwpw-00000): skip SonarQube analysis for Dependabot PRs

[github-actions]

🧪 Feature QA review — injected feature test (advisory, non-blocking)

Last updated Aug 26, 2026, 11:23 PM PT · commit 5caddcd · pull_request.

Overall: SKIPPED

Not an injectable feature -- skipped.

This is a CI workflow change that skips a SonarQube job for Dependabot PRs, with no config/card-data-driven UI behavior to exercise in the harness.

This PR's change isn't driven by config/collection data the harness can force, and the build-output-diff verdict wasn't available to consult. (The visual/smoke review still applies.)

Screenshot in the workflow run.

Review history (1 run)

• Aug 26, 2026, 11:23 PM PT · SKIPPED · 5caddcd · pull_request