From 524151ba3cde0168a9215987d31a5bca5e530907 Mon Sep 17 00:00:00 2001
From: skudasov <f4hrenh9it@gmail.com>
Date: Sun, 25 Oct 2026 14:21:02 +0100
Subject: [PATCH] In scope of
 https://smartcontract-it.atlassian.net/browse/DX-5526 we are sunsetting
 SonarQube.

Removing the jobs that run sonarsource/sonarqube-scan-action or the shared
smartcontractkit/.github ci-sonarqube-go / ci-sonarqube-ts actions.

The SonarScanner CLI downloaded by these actions bundles a Java runtime that
still trusts the compromised eMudhra roots, and no fixed release is
available yet:
- https://github.com/SonarSource/sonarqube-scan-action/pull/287
- https://github.com/SonarSource/sonar-scanner-cli/pull/312
---
 .github/workflows/go.yaml | 40 ---------------------------------------
 1 file changed, 40 deletions(-)

diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
index 6552902..bc82b93 100644
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -96,43 +96,3 @@ jobs:
             ./go/ocr2/decryptionplugin/ocr2_decryptionplugin_race_coverage.txt
             ./go/tdh2/tdh_coverage.txt
             ./go/tdh2/tdh_race_coverage.txt
-
-
-  sonar-scan:
-    name: SonarQube
-    needs: [golangci-lint, build-and-test]
-    runs-on: ubuntu-latest
-    if: always()
-    steps:
-      - name: Checkout the repo
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0 # fetch all history for all tags and branches to provide more metadata for sonar reports
-
-      - name: Download all workflow run artifacts
-        uses: actions/download-artifact@v4
-
-      - name: Update golangci-lint report symlinks 
-        # When golangci-lint is run in a multimodule project, it creates a report with relative paths to the files which should be updated
-        # The command returns true to avoid failing the workflow if the report is not found
-        continue-on-error: true
-        run: |
-          sed -i 's@file\ name="@file\ name="/github/workspace/go/ocr2/decryptionplugin/@' ./golangci-lint-report/ocr2/decryptionplugin/golangci-lint-report.xml && echo "OCR2 golangci-lint report symlinks updated"
-          sed -i 's@file\ name="@file\ name="/github/workspace/go/tdh2/@' ./golangci-lint-report/tdh2/golangci-lint-report.xml && echo "TDH2 golangci-lint report symlinks updated"
-      
-      - name: Set SonarQube Report Paths
-        id: sonarqube_report_paths
-        shell: bash
-        run: |
-          echo "sonarqube_coverage_report_paths=$(find -type f -name '*coverage.txt' -printf "%p,")" >> $GITHUB_OUTPUT
-          echo "sonarqube_golangci_report_paths=$(find -type f -name 'golangci-lint-report.xml' -printf "%p,")" >> $GITHUB_OUTPUT
-      
-      - name: SonarQube Scan
-        uses: sonarsource/sonarqube-scan-action@69c1a75940dec6249b86dace6b630d3a2ae9d2a7 # v2.0.1
-        with:
-          args: >
-            -Dsonar.go.coverage.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_coverage_report_paths }}
-            -Dsonar.go.golangci-lint.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_golangci_report_paths }}
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}