docs(refresh): SOTA-2026 handoff — SonarQube 26.7 empty project list - #7
Open
emmanuelbruno wants to merge 2 commits into
Open
emmanuelbruno wants to merge 2 commits into
emmanuelbruno wants to merge 2 commits into
Conversation
…(plugin 26.5.0 version skew) Preserve diagnosis for a fresh session: DB/ES consistent (15 TRK, UUIDs 1:1), indices GREEN, logs clean; search_projects total:15/components:[]. Leading cause = Community Branch Plugin + webapp pinned to 26.5.0 vs chart 2026.4.1 server 26.7.0. Decisive test + fix options in NEXT-STEPS.md. Isolated preservation branch (inert to ArgoCD).
There was a problem hiding this comment.
🟡 Changes recommended
One or more issues must be addressed before approval.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds a documentation-only handoff for diagnosing SonarQube 26.7’s empty project list.
Changes:
- Records observed API, database, and Elasticsearch evidence.
- Documents the suspected Community Branch Plugin version skew.
- Provides Git/worktree guidance, diagnostic steps, and follow-up checklist.
File summaries
| File | Description |
|---|---|
| refresh/sonarqube-267-empty-projects-2026-09-12/WORKDIR.txt | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/START-SOTA-2026.md | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/SITREP.md | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/NEXT-STEPS.md | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/GIT.md | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/FILES.md | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/CONTEXT.md | Updated as part of this pull request. |
| refresh/sonarqube-267-empty-projects-2026-09-12/CHECKLIST.md | Updated as part of this pull request. |
Review details
Suppressed comments (6)
refresh/sonarqube-267-empty-projects-2026-09-12/CHECKLIST.md:10
- This checklist conclusion has the same isolation problem: a successful combined removal does not prove the version-skew root cause. Record that one or both web overrides are implicated unless the agent-only and webapp-only tests are run separately.
[ ] Confirm search_projects returns non-empty components -> root cause proven.
refresh/sonarqube-267-empty-projects-2026-09-12/CONTEXT.md:21
- This section presents the UUID/
auth_resolution path as established, but the SITREP explicitly says the decisive experiment has not run. The recorded DB/ES/API counts show a discrepancy, not that the 26.5.0 agent is taking an old resolution path; please keep this causal explanation conditional until the experiment or equivalent tracing confirms it.
## Search internals (why 26.5.0 plugin breaks 26.7 search)
SonarQube 26.7 resolves components by document UUID and stores per-project auth in `auth_<uuid>`
shadow docs. The community branch plugin (javaagent + patched webapp) hooks the web/ce search path;
a 26.5.0 agent predates the 26.7 UUID/shadow-doc model, so `search_projects` returns the right
`total` but an empty `components[]`.
refresh/sonarqube-267-empty-projects-2026-09-12/GIT.md:28
- The handoff embeds
Gap-Auth: adminin the read-only commands and several evidence sections, so saying the “admin break-glass value is not stored” is inaccurate. Clarify thatadminis only the sample identity/header value and that no credential or token is included, or remove it from the examples if it is sensitive.
- No plaintext secrets/tokens. `Gap-Auth` is a header NAME; the admin break-glass value is not stored.
refresh/sonarqube-267-empty-projects-2026-09-12/NEXT-STEPS.md:26
- The preservation branch is explicitly inert, while the live Application fetches this values file from the hard-coded
mainURL inbootstrap/appset-helm.yaml:123. Committing the experiment topreservation/...as instructed here will not restart SonarQube or change the rendered release; direct the test to a deployment branch/PR that is merged tomain(or otherwise make the source branch explicit).
helm/releases/sonarqube/values.yaml, bump `?v=3`->`?v=4` on appset-helm.yaml line 123, commit to
the preservation branch, and validate render (`argocd app diff`/`helm template`) before merging.
refresh/sonarqube-267-empty-projects-2026-09-12/NEXT-STEPS.md:34
- The proposed preferred fix downgrades a persistent 26.7 installation to 26.5.x in place without accounting for the already-migrated SonarQube database. SonarQube schema downgrades are not a safe rollback path; validate 26.5 against a restored pre-26.7 database backup/snapshot, or keep the server on 26.7 while changing the plugin.
- Preferred: pin the SERVER down to match the plugin. Force image 26.5.x in values.yaml
(chart default is 26.7 — set `image.tag` explicitly) so plugin 26.5.0 + webapp 26.5.0 align.
Lowest risk, keeps branch-plugin features. Remember ?v bump.
refresh/sonarqube-267-empty-projects-2026-09-12/START-SOTA-2026.md:29
- This resume path tries to claim
sonarqube-267-empty-projects-2026-09-12fromorigin/main, butGIT.mdsays that same job and thepreservation/sonarqube-267-empty-projects-2026-09-12branch were already claimed and published. Re-running the claim can collide with the existing registration/branch instead of creating the documented worktree; resume from the existing preservation branch and reserveclaim.shfor a new working branch.
cd /home/bruno/REFRESH && ./claim.sh sonarqube-267-empty-projects-2026-09-12 origin/main
cd /tmp/wt-sonarqube-267-empty-projects-2026-09-12
- Files reviewed: 8/8 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+20
to
+21
| Prove the version-skew hypothesis: render the app WITHOUT the `=web` javaagent (and ideally WITHOUT | ||
| the 26.5.0 webapp.zip override) and re-check `search_projects`. If projects come back -> confirmed. |
Comment on lines
+37
to
+38
| 3. Pick the permanent fix (align server down to 26.5.x, OR adopt a 26.7-compatible plugin fork, | ||
| OR drop the plugin) with Bruno; implement in values.yaml; open a PR; merge; verify live. |
…x already 26.7-shaped) Read-only ES probe: components _count=30 (15 real + 15 auth_ shadow), mapping carries auth_*/join_components (the 26.7 model), GREEN, matches DB 1:1, _source disabled (normal). Reindex would rebuild the same content -> won't fix a post-ES hydration failure. No safe reindex API exists in 26.7 (only per-project issue reindex); a full rebuild = wipe ES + restart = worse than the reversible =web javaagent test. internal_properties has no reindex trigger (0 rows). Decision: skip reindex, go straight to the javaagent-disable diagnostic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Diagnostic handoff only (branch inert to ArgoCD — no source/values changes).
Findings
search_projectstotal:15 / components:[];projects/searchtotal:0.helm/releases/sonarqube/values.yamllines 5/40/53/55) vs chart 2026.4.1 server 26.7.0.Contents: refresh/sonarqube-267-empty-projects-2026-09-12/ (WORKDIR, SITREP, CONTEXT, FILES, NEXT-STEPS, CHECKLIST, GIT, START-SOTA-2026).
Next session should run the decisive test (disable the
=webjavaagent via Git +?vcache-bust bump) — see NEXT-STEPS.md. Do not merge this branch to main; it is a docs/preservation artifact. Close or leave open as a reference.