fix(sonar): harden tailnet path before SonarQube scan (roll out infra-portal#1179) - #322
Merged
Merged
Conversation
`tailscale up` returns before the DERP/route path has settled, so the scanner's first call (GET /api/v2/analysis/version) can hit a half-open path and fail fast with "Failed to query server version ... failed: null". The scanner's default connect timeout is only 5s, so this surfaces as a flaky Sonar failure requiring several CI retries across Kotlin services (ocpp, notifications, data-broker, alerts, ...). Port the hardening Jonas landed in infra-portal#1179 into the two shared reusable workflows so every consumer (@main) picks it up at once: add a curl probe that polls the exact health endpoint until reachable before the scan runs. This both waits out the race and warms the relay path. Guarded with the same conditions as the scan step and `continue-on-error: sonar-non-blocking`, so it composes with the existing non-blocking behaviour (#320/#321) and the SonarCloud path when Tailscale is skipped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
joscdk
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ports the tailscale-hardening fix from infra-portal#1179 into the two shared reusable workflows so it rolls out to every Kotlin service at once (all consumers pin
@main):pull-request-kotlin.yml— before Upload results to SonarQubesonar-cloud.yml— before Analyze with SonarQubeAdds a "Wait for SonarQube to be reachable over the tailnet" step: a
curlprobe that pollshttps://sonarqube.vpn.internal.monta.app/api/v2/analysis/version(the exact endpoint the scanner hits first) until it answers, then lets the scan proceed.Why
tailscale upreturns before the DERP/route path has actually settled (we can't do direct connections, so traffic relays via DERP). The scanner's first call hits a half-open path and fails fast — its default connect timeout is only 5s — surfacing as the cryptic:This has been forcing several CI retries across service-ocpp, service-notifications, service-data-broker, service-alerts, etc. Polling the endpoint both waits out the race and warms the relay path, so the scan starts on a connection we know works.
Safety / composition
if:conditions as the scan step it precedes, pluscontinue-on-error: \${{ inputs.sonar-non-blocking }}— so it composes cleanly with the non-blocking behaviour from chore: make SonarQube + Tailscale non-blocking in Kotlin CI [CPONETOPS-1078] #320/chore: skip SonarQube scan when Tailscale bring-up fails [CPONETOPS-1078] #321 and doesn't affect the SonarCloud path when Tailscale is skipped.Follow-ups (not in this PR)
connectTimeout/responseTimeout(infra-portal#1179 also did this, but there Sonar runs viasonarqube-scan-action; here it runs via thegradle-multi-moduleaction, so it'd need to go through gradle args).Picks up the rollout Jonas flagged in #request-sre / #github.
🤖 Generated with Claude Code