From b8863ec43a07f35618019ae5358c2c7708ac9a62 Mon Sep 17 00:00:00 2001
From: Emmanuel Bruno <emmanuel.bruno@univ-tln.fr>
Date: Wed, 16 Sep 2026 08:52:45 +0200
Subject: [PATCH] =?UTF-8?q?fix(sonarqube):=20reset=20to=20aligned=2026.5.0?=
 =?UTF-8?q?=20+=20CBP=2026.5.0=20on=20fresh=20data;=20DB=E2=86=92PG16?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 bootstrap/appset-helm.yaml              |  2 +-
 helm/releases/sonarqube/values.yaml     | 29 ++++++++++++++++++-------
 kubernetes/postgresql/sonarqube-db.yaml |  1 +
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/bootstrap/appset-helm.yaml b/bootstrap/appset-helm.yaml
index b6d05c3..25ecef8 100644
--- a/bootstrap/appset-helm.yaml
+++ b/bootstrap/appset-helm.yaml
@@ -120,7 +120,7 @@ spec:
         repoURL: https://SonarSource.github.io/helm-chart-sonarqube
         version: 2026.4.1
         syncWave: '20'
-        valueURL: https://raw.githubusercontent.com/ebpro/gitops/main/helm/releases/sonarqube/values.yaml?v=6
+        valueURL: https://raw.githubusercontent.com/ebpro/gitops/main/helm/releases/sonarqube/values.yaml?v=7
       - app: tempo
         chart: tempo
         namespace: tempo
diff --git a/helm/releases/sonarqube/values.yaml b/helm/releases/sonarqube/values.yaml
index 5802aa1..d25368e 100644
--- a/helm/releases/sonarqube/values.yaml
+++ b/helm/releases/sonarqube/values.yaml
@@ -1,17 +1,26 @@
 community:
   enabled: true
 extraInitContainers:
-  - name: cleanup-branch-plugin
-    image: busybox:1.37
+  - args:
+      - wget -O /tmp/sonarqube-webapp.zip https://github.com/mc1arke/sonarqube-community-branch-plugin/releases/download/26.5.0/sonarqube-webapp.zip && unzip -o /tmp/sonarqube-webapp.zip -d /web && chmod -R 755 /web && chown -R 1000:0 /web && rm -f /tmp/sonarqube-webapp.zip
     command:
       - sh
       - -c
-    args:
-      - rm -f /opt/sonarqube/extensions/plugins/sonarqube-community-branch-plugin-*.jar && echo removed-stale-branch-plugin || echo no-stale-branch-plugin
+    image: busybox:1.37
+    name: download-webapp
     volumeMounts:
-      - mountPath: /opt/sonarqube/extensions
-        name: sonarqube
-        subPath: extensions
+      - mountPath: /web
+        name: webapp
+extraVolumeMounts:
+  - mountPath: /opt/sonarqube/web
+    name: webapp
+extraVolumes:
+  - emptyDir:
+      sizeLimit: 50Mi
+    name: webapp
+image:
+  repository: sonarqube
+  tag: 26.5.0.122743-community
 jdbcOverwrite:
   enabled: true
   jdbcSecretName: sonarqube-db-app
@@ -29,6 +38,9 @@ persistence:
   enabled: true
   size: 20Gi
   storageClass: local-path
+plugins:
+  install:
+    - https://github.com/mc1arke/sonarqube-community-branch-plugin/releases/download/26.5.0/sonarqube-community-branch-plugin-26.5.0.jar
 prometheusMonitoring:
   podMonitor:
     enabled: true
@@ -40,9 +52,10 @@ resources:
   requests:
     cpu: 500m
     memory: 2Gi
-  # TEMP 2026-09-15 (sonarqube-267-empty-projects): E1 — 26.5.0 community branch plugin stack fully removed (jar + ce/web agents) to test stock 26.7. Branch/PR analysis disabled while this is live.
 sonarProperties:
+  sonar.ce.javaAdditionalOpts: -javaagent:/opt/sonarqube/extensions/plugins/sonarqube-community-branch-plugin-26.5.0.jar=ce
   sonar.security.textblock.cipherType: AES256
+  sonar.web.javaAdditionalOpts: -javaagent:/opt/sonarqube/extensions/plugins/sonarqube-community-branch-plugin-26.5.0.jar=web
   sonar.web.sso.enable: "true"
   sonar.web.sso.loginHeader: "Gap-Auth"
   sonar.web.sso.nameHeader: "Gap-Auth"
diff --git a/kubernetes/postgresql/sonarqube-db.yaml b/kubernetes/postgresql/sonarqube-db.yaml
index f2c7061..6e4d1bd 100644
--- a/kubernetes/postgresql/sonarqube-db.yaml
+++ b/kubernetes/postgresql/sonarqube-db.yaml
@@ -5,6 +5,7 @@ metadata:
   namespace: sonarqube
 spec:
   instances: 1
+  image: ghcr.io/cloudnative-pg/postgresql:16.15-system-trixie
   bootstrap:
     initdb:
       database: app