From aa15894167e131488904a8f5401890d465ed2d81 Mon Sep 17 00:00:00 2001
From: Travis <travis.lyons@sourcegraph.com>
Date: Tue, 15 Sep 2026 16:44:57 +0000
Subject: [PATCH 1/2] Build: add a project-specific SonarQube scan

Configures the org.sonarqube plugin so each spring-* sub-module is analyzed
as its own SonarQube project keyed org.springframework:<module>, rather than
as a single aggregated scan of the whole build. Each module's configuration
lives in its own build file so it can be reviewed and merged independently.

Server URL and token are read from the SONAR_HOST_URL and SONAR_TOKEN
environment variables rather than being hardcoded.
---
 .github/workflows/sonar.yml | 56 +++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 .github/workflows/sonar.yml

diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 000000000000..8d6c57cbe66c
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,56 @@
+name: SonarQube
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  sonar:
+    name: SonarQube (${{ matrix.module }})
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.module }}
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - spring-aop
+          - spring-aspects
+          - spring-beans
+          - spring-context
+          - spring-context-indexer
+          - spring-context-support
+          - spring-core
+          - spring-core-test
+          - spring-expression
+          - spring-instrument
+          - spring-jdbc
+          - spring-jms
+          - spring-messaging
+          - spring-orm
+          - spring-oxm
+          - spring-r2dbc
+          - spring-test
+          - spring-tx
+          - spring-web
+          - spring-webflux
+          - spring-webmvc
+          - spring-websocket
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare Gradle Build
+        uses: ./.github/actions/prepare-gradle-build
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          java-distribution: liberica
+          java-early-access: false
+          java-toolchain: false
+          java-version: 25
+      - name: Scan Module
+        env:
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: ./gradlew :${{ matrix.module }}:test :${{ matrix.module }}:sonar

From 0dd40845136577e31b2f551df7f887df72d859f5 Mon Sep 17 00:00:00 2001
From: Travis <travis.lyons@sourcegraph.com>
Date: Tue, 15 Sep 2026 16:56:18 +0000
Subject: [PATCH 2/2] Fix for changeset check failure on
 sonarqube-workflow-4860776c-28c6-4cbd-9347-d1fe28aa7678

---
 .github/workflows/sonar.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 8d6c57cbe66c..dc17f70fe7b0 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -3,7 +3,6 @@ on:
   push:
     branches:
       - 'main'
-  pull_request:
 permissions:
   contents: read
 jobs: