SONARJAVA-6247 Use orchestrator-cache in autoscan tests

[tomasz-tylenda-sonarsource]

• We forgot autoscan when adding caching to plugin and ruling qa.
• Tested: https://github.com/SonarSource/sonar-java/actions/runs/24245885636/job/70792206325 downloads sonarqube-enterprise-lw-2026.2.1.121354.zip which was previousy caches by other qa jobs.

[hashicorp-vault-sonar-prod]

SONARJAVA-6247

[sonar-review-alpha]

Summary

Adds orchestrator-cache to the autoscan CI workflow job, bringing it in line with the caching strategy already applied to plugin and ruling QA jobs. This avoids redundant downloads of the SonarQube artifact by reusing versions cached by other jobs in the same workflow run. Changes the SonarQube version from a hardcoded parameter to an environment variable that coordinates with the cache action.

What reviewers should know

What changed:

• New orchestrator-cache action step inserted before Run autoscan tests (lines 332–335)
• Added SQ_VERSION environment variable to define the SonarQube version
• Maven parameter changed from -Dsonar.runtimeVersion=LATEST_RELEASE to -Dsonar.runtimeVersion="$SQ_VERSION" to use the env var

For reviewers:
The diff is straightforward — the autoscan job now uses the same caching mechanism as plugin and ruling QA (via the reusable ./.github/actions/orchestrator-cache action). No changes to test logic or other workflow steps. The author confirmed in testing that the cached artifact is properly reused across jobs.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, focused change that brings the autoscan job in line with the caching pattern already used by ruling and plugin-qa. The SQ_VERSION env var is wired correctly through both the orchestrator-cache action and the Maven -Dsonar.runtimeVersion property, and the cache action handles LATEST_RELEASE as expected.

🗣️ Give feedback

[dorian-burihabwa-sonarsource]

LGTM but I think it would be nicer if we moved the starting double a bit further

[dorian-burihabwa-sonarsource]

Thanks for the change!

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube