From 47af08891657fcd8bc4126cea2021c4fe2e9ac8c Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Mon, 26 Oct 2026 18:30:27 +0000
Subject: [PATCH] Let the required Sonar App gate decide queued analyses

---
 scripts/qualification_policy.py      | 2 +-
 tests/fixtures/merge-queue-sonar.yml | 5 +++--
 tests/test_qualification_policy.py   | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/scripts/qualification_policy.py b/scripts/qualification_policy.py
index 410847a..bb29e52 100644
--- a/scripts/qualification_policy.py
+++ b/scripts/qualification_policy.py
@@ -1081,7 +1081,7 @@ def _merge_queue_sonar_workflow(document: dict[str, Any], target: str, path: str
              "-Dsonar.scm.exclusions.disabled=true "
              "-Dsonar.rust.clippy.enabled=false "
              "-Dsonar.working.directory=${{ runner.temp }}/queue-sonar-work "
-             "-Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=300"
+             "-Dsonar.qualitygate.wait=false"
          )}},
     ]
 
diff --git a/tests/fixtures/merge-queue-sonar.yml b/tests/fixtures/merge-queue-sonar.yml
index c76f761..fd24c0f 100644
--- a/tests/fixtures/merge-queue-sonar.yml
+++ b/tests/fixtures/merge-queue-sonar.yml
@@ -49,6 +49,8 @@ jobs:
 
       # No candidate command, dependency installation or scanner configuration
       # executes with this token. Only the pinned static scanner receives it.
+      # The required Sonar App check gates this SHA. Upload the analysis and
+      # let GitHub wait for that App's quality-gate result.
       - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -60,5 +62,4 @@ jobs:
             -Dsonar.scm.exclusions.disabled=true
             -Dsonar.rust.clippy.enabled=false
             -Dsonar.working.directory=${{ runner.temp }}/queue-sonar-work
-            -Dsonar.qualitygate.wait=true
-            -Dsonar.qualitygate.timeout=300
+            -Dsonar.qualitygate.wait=false
diff --git a/tests/test_qualification_policy.py b/tests/test_qualification_policy.py
index 6398fda..6c70f0c 100644
--- a/tests/test_qualification_policy.py
+++ b/tests/test_qualification_policy.py
@@ -236,7 +236,7 @@ def test_merge_queue_sonar_refuses_candidate_execution_and_privilege_expansion(s
             source.replace("queue-sonar-work", ".sonar-candidate/.scannerwork"),
             source.replace("projectBaseDir: .sonar-candidate", "projectBaseDir: ."),
             source.replace("sonar.rust.clippy.enabled=false", "sonar.rust.clippy.enabled=true"),
-            source.replace("qualitygate.timeout=300", "qualitygate.timeout=300 -Dsonar.host.url=https://example.invalid"),
+            source.replace("qualitygate.wait=false", "qualitygate.wait=false -Dsonar.host.url=https://example.invalid"),
             source + "      - run: ./.sonar-candidate/after-scan.sh\n",
             source + "      - uses: ./candidate-action # local\n",
         ]