[aaltat]

Closes #5427

Summary

push to main
  sonarqube job (not in publish_nightly's needs)
    install Node and Python deps, inv protobuf
    robocop check atest                                 -> robocop_sonar_qube.json
    ruff check Browser browser_batteries atest          -> ruff.json
    mypy Browser browser_batteries atest/library        -> mypy.txt
    if SONAR_TOKEN is set: sonarqube-scan-action

Differences from the properties in #5418:

-sonar.organization=marketsquare
+sonar.organization=marketsquare-1
-sonar.sources=Browser,node/playwright-wrapper,atest
+sonar.sources=Browser,browser_batteries,node/playwright-wrapper,atest,.github

• marketsquare-1 is the organization that owns the project on SonarQube Cloud.
• .github is needed for GitHub Actions findings.
• browser_batteries is part of the library. mypy also needs it to resolve an import.
• The reports cover more than inv lint: ruff includes atest, and mypy includes atest/library. utest is left out of mypy because it makes mypy exit 2.

Evidence

• Before: no CI analysis. The existing analyses come from Automatic Analysis, which is now off, and they carry no linter findings.
  After: a local SonarQube Community Build scan of a clean checkout imported every finding, and the .github YAML files were indexed.

Source	Findings imported
Robocop	268
ruff	70
mypy	22

That scan ran before browser_batteries was added. Ruff was rerun with it and still reports 70 findings, none of them in browser_batteries.

Not proven yet:

• The job itself has not run, because it only runs on pushes to main. actionlint passes.
• GitHub Actions findings. Community Build has no rules for them. Automatic Analysis reported 114 on Cloud.
• The dashboard criterion can only be checked after the first run on main.

Merge Danger

Door: two-way

Reverting the commit removes the job. Analyses already sent to SonarQube Cloud stay in its history.

Blast Radius: CI-only

The job is advisory, and a failure here cannot hold back the nightly. A failure would still mark the main run red. The dashboard gains about 360 linter findings, and the 268 from Robocop are new because inv lint-robot only formats.

🤖 Generated with Claude Code