fix(sonarcloud): derive the project key from the repo so new repos need no per-repo edit

Merged
DO
3d ago
+86-29

Problem

sonar-project.properties shipped with sonar.projectKey=combsmith_repo-template, and BOOTSTRAP.md step 6 relied on the bootstrapping agent to change it. Until that step landed, every repo created from the template (observed on combsmith/worldchest, created 2026-10-20) had its day-0 push to main analysed into the template's SonarCloud project, and its first PR's SonarCloud check failed with Could not find the pullrequest with key '1' because that PR does not exist in the template's project.

This PR makes sonarcloud.yml derive the identity from the repo, so there is nothing to edit:

  • Both scan steps (first + retry) pass args: -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }} -Dsonar.organization=${{ github.repository_owner }}. SonarCloud auto-provisions a project for a new key on first scan (seen on combsmith_template-smoke-20261019 and combsmith_worldchest).
  • sonar-project.properties is reduced to the stack-agnostic lines (sonar.sources=. + exclusions); the hard-coded key/organization and the "Customize…" comment are gone.
  • tests/sonarcloud-stub.bats gains two guards: the derived args are present on both scan steps, and the properties file pins no key/organization. Every existing invariant (job name, continue-on-error + 30 s backoff + single retry, permissions, SHA pins, no TODO) is unchanged.
  • BOOTSTRAP.md step 6 becomes "nothing to set unless sonar.sources / sonar.tests need narrowing"; the sonar key is removed from the inputs table, the inventory and the done criteria. README day-0 row and the copilot-instructions.md file-map note updated to match.

Follow-up (second PR, same session): mirror README.md / BOOTSTRAP.md / sonar-project.properties into seed-repo-template.sh in combsmith/.github-private so the next seed does not revert this.

Risk

Low. The workflow still reads sonar-project.properties for sources/exclusions; only the identity moves to args:. For this repo the derived key is combsmith_repo-template, identical to the old hard-coded value, so the template's own project history is unaffected. A repo that already set its own key in the properties file is unaffected too (same value either way); a mismatch would be caught by SonarCloud at the first scan.

Test plan

  • bats tests/ locally: 139 ok, 8 not ok, all 8 = dependabot-github-actions-ecosystem.bats setup (yq missing locally, pre-existing env gap). tests/sonarcloud-stub.bats 13/13 including the two new guards.
  • The SonarCloud check on this PR must pass under the derived key (same value as before).
  • Validation comment with the output follows.

Rollback

Revert the squash commit. The old hard-coded key returns, as does BOOTSTRAP step 6 telling the agent to set it.

Monitoring

The next repo created from the template: its day-0 push should create combsmith_<name> in SonarCloud automatically, and its first PR's SonarCloud check should be green without any edit to sonar-project.properties. tests/sonarcloud-stub.bats guards against regression on the template itself.

🤖 Generated with Claude Code