Split out from #138 / PR #147.
What was found
PR #147 fixed every configuration defect in code_quality.yml and qodana.yaml (wrong solution file, missing sibling clones, clones invisible to the analysis container, unmounted volumes, ineffective exclude globs, a job timeout below the build time, a missing SARIF-existence gate). Dispatch 33428446669 — the first run ever to get past solution loading — then failed on something none of that can address:
Your Qodana Cloud organization has Community license that doesn't support "Qodana for .NET"
linter, please try one of the community linters instead: "Qodana Community for JVM",
"Qodana Community for Python", ...
The licence check runs before the solution is opened, so no SARIF is produced regardless of configuration. upload-sarif therefore still cannot run to completion, which is the closure criterion #138 set for itself.
Options
- Buy a Qodana Ultimate licence for the
mrploch organisation (jetbrains/qodana-dotnet needs it).
- Drop Qodana for .NET and rely on the analysis already in the pipeline — SonarCloud, Codacy, CodeQL, and the StyleCop / Roslynator / SonarAnalyzer
GlobalPackageReference set that runs on every build.
- Delete
code_quality.yml and qodana.yaml outright if option 2 is chosen.
Option 2 is the cheapest and loses little: the .NET-specific inspections Qodana adds overlap heavily with what SonarCloud and the in-build analysers already report.
Acceptance
Either a Qodana .NET scan completes and upload-sarif publishes a SARIF to code scanning at least once, or the workflow is removed and #138 is closed as won't-fix with that rationale recorded.
Split out from #138 / PR #147.
What was found
PR #147 fixed every configuration defect in
code_quality.ymlandqodana.yaml(wrong solution file, missing sibling clones, clones invisible to the analysis container, unmounted volumes, ineffective exclude globs, a job timeout below the build time, a missing SARIF-existence gate). Dispatch 33428446669 — the first run ever to get past solution loading — then failed on something none of that can address:The licence check runs before the solution is opened, so no SARIF is produced regardless of configuration.
upload-sariftherefore still cannot run to completion, which is the closure criterion #138 set for itself.Options
mrplochorganisation (jetbrains/qodana-dotnetneeds it).GlobalPackageReferenceset that runs on every build.code_quality.ymlandqodana.yamloutright if option 2 is chosen.Option 2 is the cheapest and loses little: the .NET-specific inspections Qodana adds overlap heavily with what SonarCloud and the in-build analysers already report.
Acceptance
Either a Qodana .NET scan completes and
upload-sarifpublishes a SARIF to code scanning at least once, or the workflow is removed and #138 is closed as won't-fix with that rationale recorded.