BUILD-10993: Migrate SonarJS workflows to sonar-m-docker and sonar-*-public runners by hedinasr · Pull Request #6730 · SonarSource/SonarJS

hedinasr · 2026-04-01T10:07:16Z

BUILD-10993: Migrate SonarJS to sonar-m-docker and sonar-*-public runners

Replace github-ubuntu-latest-s/github-ubuntu-latest-m runners with SonarSource self-hosted runners across all workflows.

Runner mapping

sonar-m-docker — Docker image build jobs (docker-a3s.yml, docker-a3s-repox.yml) and all Linux CI jobs in build.yml (unit tests, QA, ruling, etc.)
sonar-xs-public — lightweight jobs: PR/review event workflows (PullRequestCreated, PullRequestClosed, RequestReview, SubmitReview), bump-versions, dogfood, release_eslint_plugin, update-eslint-plugin-changelog

npm registry routing

Self-hosted runners block direct npmjs access. The manual "Configure npm registry" step and ARTIFACTORY_ACCESS_TOKEN vault secret have been replaced by SonarSource/ci-github-actions/config-npm@v1, which handles Repox routing automatically.

Notes

populate_npm_cache_win stays on github-windows-latest-s (Windows runner, unchanged)
automated-release.yml: the runner-environment field is a workflow call input passed to SonarSource/release-github-actions, not a runs-on label — intentionally left unchanged

Part of the Milestone 5 effort tracked under BUILD-10864.

hashicorp-vault-sonar-prod · 2026-04-01T10:08:35Z

BUILD-10864

github-actions · 2026-04-01T10:16:59Z

Ruling Report

✅ No changes to ruling expected issues in this PR

sonarqube-next · 2026-04-01T10:35:45Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

github-actions · 2026-04-09T11:17:00Z

README Freshness Check

❌ The rules README is out of date.

A fix PR has been created: #6829

Please review and merge it into your branch.

Co-authored-by: Hedi Nasr <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Hedi Nasr <[email protected]>

…public runners

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

zglicz · 2026-04-15T20:25:58Z

@copilot resolve the merge conflicts in this pull request

sonar-review-alpha · 2026-04-15T20:26:31Z

Summary

This PR migrates SonarJS workflows from GitHub-hosted runners to SonarSource self-hosted runners and improves npm registry handling on self-hosted runners.

Runner changes: Replaces github-ubuntu-latest-s and github-ubuntu-latest-m with:

sonar-xs-public for lightweight jobs (PR/review events, setup, analysis, fast QA)
sonar-m-public for medium-load jobs (unit tests, plugin QA)
sonar-m-docker for Docker builds and Docker-based Alpine tests
sonar-xl-public for heavy lifting (JS/TS ruling, ruling tests)

npm registry routing: Self-hosted runners block direct npmjs access. All workflows now use SonarSource/ci-github-actions/config-npm@v1 instead of manual vault secret + npm config steps. This is handled transparently in build.yml, docker-a3s.yml, and docker-a3s-repox.yml.

Code improvement: packages/http/src/memory.ts now correctly considers Docker memory limits when validating Node.js heap size, fixing a false-positive warning on containerized environments. Windows builds (populate_npm_cache_win) remain on GitHub runners and continue using vault secrets—no change needed there.

What reviewers should know

Where to start: Review workflow changes by category:

npm registry changes (build.yml lines ~107-125, docker files): Verify config-npm@v1 handles Repox routing correctly. The conditional on runner.os ensures Windows runners still use vault secrets.
Memory handling (packages/http/src/memory.ts): Check that getAvailableMemory() correctly picks the lower limit and that tests cover edge cases (Docker limit < OS, Docker limit > OS, no Docker limit).
Node disabling approach (build.yml ~788-795): The bash function replaces sudo-based node disabling—simpler and portable, but confirm the function export works in the workflow context.

Non-obvious decisions:

sonar-xl-public for ruling tests (not sonar-m-docker) suggests these need higher resources than Docker-based jobs
dogfood.yml uses sonar-m-docker (not sonar-xs-public) despite being lightweight—likely needs Docker or specific tools
Windows runner migration is intentionally skipped (populate_npm_cache_win stays on github-windows-latest-s)

Gotchas:

automated-release.yml is not touched—the PR description notes its runner-environment is an input, not a runs-on label (correct)
The memory warning threshold now uses effective available memory (min of OS/Docker), which could suppress warnings on under-provisioned containers—verify this is desired behavior
npm config changes are Windows-specific in build.yml (line ~114) but not in docker files, which only run on Linux

Generate Walkthrough
Generate Diagram

🗣️ Give feedback

sonar-review-alpha

Three issues need fixing before merge — two commented-out job conditions look like debugging artifacts that would trigger jobs far too broadly, and the node-disabling approach is broken on self-hosted runners.

🗣️ Give feedback

sonar-review-alpha · 2026-04-15T20:28:26Z

+          function node() {
+            echo "node is disabled"
+            exit 0
+          }
+          export -f node
+
+          node


The bash function override does not disable node for subsequent steps. In GitHub Actions, each step spawns a fresh shell process — export -f node only propagates to child processes launched from this step's shell, not to the next step. The Run Plugin QA without Node step at line 793 will run with the real node binary fully accessible, making this job's constraint meaningless.

The old sudo mv approach worked because it modified the filesystem (persisting across steps). Options for self-hosted runners without sudo:

Use PATH manipulation: prepend a directory with a fake node wrapper that errors out, then persist it via $GITHUB_PATH

Or simply accept that these runners have node available and rely on the test itself to verify no-node behaviour

Suggested change

function node() {

echo "node is disabled"

exit 0

}

export -f node

node

# Prepend a fake 'node' shim that the QA step will see

mkdir -p "$RUNNER_TEMP/no-node"

printf '#!/bin/sh\necho "node is disabled" >&2\nexit 1\n' > "$RUNNER_TEMP/no-node/node"

chmod +x "$RUNNER_TEMP/no-node/node"

echo "$RUNNER_TEMP/no-node" >> "$GITHUB_PATH"

# Verify shim is active

if node --version 2>/dev/null; then

echo "ERROR: node is still accessible!"

exit 1

else

echo "SUCCESS: node is no longer accessible"

fi

Mark as noise

Co-authored-by: sonar-review-alpha[bot] <266116024+sonar-review-alpha[bot]@users.noreply.github.com>

…SonarMDocker

sonar-review-alpha

LGTM! ✅

The previously flagged issue — export -f node not persisting across steps — remains unresolved in this PR. The plugin_qa_without_node job still uses the bash function override approach, which only affects the current step's shell, not subsequent steps where the actual QA runs.

🗣️ Give feedback

sonarqube-next · 2026-04-16T07:48:40Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
87.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

hedinasr force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch from d234a88 to 546fd7d Compare April 1, 2026 10:25

hedinasr force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch 2 times, most recently from a363064 to e32820f Compare April 1, 2026 12:04

hedinasr force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch from e32820f to e6956d4 Compare April 9, 2026 11:12

github-actions bot mentioned this pull request Apr 9, 2026

Update rules README for PR #6730 #6755

Merged

hedinasr force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch from e6956d4 to 9012a41 Compare April 10, 2026 08:12

hedinasr force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch from 098feb4 to b5f7b97 Compare April 10, 2026 08:37

github-actions bot mentioned this pull request Apr 10, 2026

Update rules README for PR #6730 #6761

Closed

hedinasr force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch 4 times, most recently from 06803e3 to 965c2b8 Compare April 10, 2026 13:56

hedinasr changed the title ~~BUILD-10864: Migrate docker-a3s workflows to sonar-m-docker~~ BUILD-10993: Migrate SonarJS workflows to sonar-m-docker and sonar-*-public runners Apr 13, 2026

zglicz force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch from 965c2b8 to 3d12462 Compare April 15, 2026 08:01

BUILD-10993: Migrate SonarJS workflows to sonar-m-docker and sonar-*-…

396b422

…public runners

zglicz force-pushed the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch from 3d12462 to 396b422 Compare April 15, 2026 08:05

zglicz added 2 commits April 15, 2026 10:27

BUILD-10993: respect docker memory limit in memory warning

a4bfa44

BUILD-10993: simplify memory limit conditionals

37db990

github-actions bot mentioned this pull request Apr 15, 2026

Update rules README for PR #6730 #6822

Merged

Update rules README for PR #6730 (#6822)

793e960

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

github-actions bot mentioned this pull request Apr 15, 2026

Update rules README for PR #6730 #6829

Merged

github-actions bot and others added 2 commits April 15, 2026 15:42

Update rules README for PR #6730 (#6829)

f8457c2

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

BUILD-10864 run ESLint plugin CI on github ubuntu runners

898b37c

zglicz marked this pull request as ready for review April 15, 2026 20:25

sonar-review-alpha bot reviewed Apr 15, 2026

View reviewed changes

zglicz and others added 2 commits April 16, 2026 07:53

Update .github/workflows/build.yml

22c45b9

Co-authored-by: sonar-review-alpha[bot] <266116024+sonar-review-alpha[bot]@users.noreply.github.com>

Update .github/workflows/build.yml

d30058d

Co-authored-by: sonar-review-alpha[bot] <266116024+sonar-review-alpha[bot]@users.noreply.github.com>

This comment was marked as outdated.

Sign in to view

Merge branch 'master' into chore/hnasr/BUILD-10864-migrateDockerA3sTo…

5493e66

…SonarMDocker

sonar-review-alpha bot reviewed Apr 16, 2026

View reviewed changes

zglicz requested a review from vdiez April 16, 2026 07:59

vdiez approved these changes Apr 16, 2026

View reviewed changes

zglicz merged commit b996564 into master Apr 16, 2026
82 of 83 checks passed

zglicz deleted the chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker branch April 16, 2026 08:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BUILD-10993: Migrate SonarJS workflows to sonar-m-docker and sonar-*-public runners#6730

BUILD-10993: Migrate SonarJS workflows to sonar-m-docker and sonar-*-public runners#6730
zglicz merged 9 commits intomasterfrom
chore/hnasr/BUILD-10864-migrateDockerA3sToSonarMDocker

hedinasr commented Apr 1, 2026 •

edited by atlassian bot

Loading

Uh oh!

hashicorp-vault-sonar-prod bot commented Apr 1, 2026 •

edited by atlassian bot

Loading

Uh oh!

github-actions bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

sonarqube-next bot commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

zglicz commented Apr 15, 2026

Uh oh!

sonar-review-alpha bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

sonar-review-alpha bot left a comment

Uh oh!

sonar-review-alpha bot Apr 15, 2026

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

sonar-review-alpha bot left a comment

Uh oh!

sonarqube-next bot commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-          function node() {
-            echo "node is disabled"
-            exit 0
-          }
-          export -f node
-          node
+          # Prepend a fake 'node' shim that the QA step will see
+          mkdir -p "$RUNNER_TEMP/no-node"
+          printf '#!/bin/sh\necho "node is disabled" >&2\nexit 1\n' > "$RUNNER_TEMP/no-node/node"
+          chmod +x "$RUNNER_TEMP/no-node/node"
+          echo "$RUNNER_TEMP/no-node" >> "$GITHUB_PATH"
+          # Verify shim is active
+          if node --version 2>/dev/null; then
+            echo "ERROR: node is still accessible!"
+            exit 1
+          else
+            echo "SUCCESS: node is no longer accessible"
+          fi

Conversation

hedinasr commented Apr 1, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BUILD-10993: Migrate SonarJS to sonar-m-docker and sonar-*-public runners

Runner mapping

npm registry routing

Notes

Uh oh!

hashicorp-vault-sonar-prod bot commented Apr 1, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ruling Report

Uh oh!

sonarqube-next bot commented Apr 1, 2026

Quality Gate passed

Uh oh!

github-actions bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

README Freshness Check

Uh oh!

zglicz commented Apr 15, 2026

Uh oh!

sonar-review-alpha bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What reviewers should know

Uh oh!

sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqube-next bot commented Apr 16, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hedinasr commented Apr 1, 2026 •

edited by atlassian bot

Loading

hashicorp-vault-sonar-prod bot commented Apr 1, 2026 •

edited by atlassian bot

Loading

github-actions bot commented Apr 1, 2026 •

edited

Loading

github-actions bot commented Apr 9, 2026 •

edited

Loading

sonar-review-alpha bot commented Apr 15, 2026 •

edited

Loading