[hyperpolymath]

Summary

The SonarQube job is red on each run of this repository, on main and on each pull request. The run log (job 130101445937) shows an empty token:

env:
  SONAR_TOKEN:
##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
ERROR Fail to load the list of plugins installed on the server: Not authorized or organization not found

That red check is not a code-quality signal, because the scan did not run. This PR adds the token guard of the estate template.

Changes

• sonarqube.yml: a first step tests SONAR_TOKEN.
  • With no token, the job writes a notice that the scan is not configured, and passes.
  • With a token, the checkout and the scan run as before, with no further edit of this file.
  • The token is in the environment of the guard step and of the scan step only.

The text is the guard of hyperpolymath/rsr-template-repo. The gitbot-fleet recipe scripts/fix-sonarqube-token-guard.sh wrote it. system-et has the same guard.

RSR Quality Checklist

Required

• Tests pass (just test or equivalent): not run, the change is 1 workflow file
• Code is formatted (just fmt or equivalent): not run, same reason
• Linter is clean (no new warnings or errors): not run locally, the PR checks give the result
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

None of the listed documents changes.

Testing

• The recipe's own check (--check) reported a target before the edit (1) and no target after it (0).
• yq parses the file; the job has 3 steps.
• The run of the SonarQube job on this pull request is the proof: it must pass with the notice.

Notes for the owner, not changed here:

• sonar-project.properties has sonar.projectKey=hyperpolymath_anytype. The SonarCloud app analyses this repository as hyperpolymath_everytype. If you add a SONAR_TOKEN secret later, check that the project key exists in SonarCloud.
• The header comment of sonarqube.yml has the project link of the template (id=hyperpolymath_rsr-template-repo).

---

Generated by Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Summary

Summary by CodeRabbit

• Chores
  • Automated code-quality scans now run only when the required credentials are available. If they are not configured, the scan is skipped instead of attempting to run. This keeps CI results aligned with the available configuration and avoids failures caused by missing scan credentials. No user-facing product features or behaviour have changed.

The SonarQube workflow checks whether SONAR_TOKEN is set. It skips checkout and scanning when the token is empty.

Changes: Conditional SonarQube scan

Layer / File(s)	Summary
Token check and scan gating .github/workflows/sonarqube.yml	A Bash step sets the configured output according to whether SONAR_TOKEN is empty. Checkout and the SonarQube scan run only when the output is true.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: Low · up to 6a9b8

Fork contributors may receive misleading setup guidance when the scan is skipped. The change is mergeable with that limitation understood.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-10T21:24:34.378917Z We couldn’t complete this review. Comment @codex review to try again.	6a9b85a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud