[tomshafir-sonarsource]

Description

Update SonarQube from 2.6.0 to 2.7.0 by changing version and source.ref in .github/plugin/marketplace.json and plugins/external.json.

Release tag: https://github.com/SonarSource/sonarqube-agent-plugins/tree/2.7.0

Pull Request Checklist

• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested the plugin with GitHub Copilot.
• I have run npm run build and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

Type of Contribution

• Update to existing plugin.

Validation

• npm run plugin:validate passed.
• npm run build passed.
• JSON parsing and git diff --check passed.

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• plugins/external.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Plugin and extension validation	✅ Passed	Passed · logs
Plugin structure	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs
Canvas/plugin smoke test	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for db7599c · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🛑 External plugin PR checks failed (submitter fixes required)

• Changed entries detected: 1
• Workflow state label: requires-submitter-fixes
• Full logs: Download quality gate artifact
• Status legend: ✅ pass · ⚠️ warning · 🛑 fail

Per-plugin quality summary

Plugin	spec compliance	vally lint	install smoke test	version match	ref/sha consistency	canvas structure	overall	source tree
sonarqube	🛑 fail	✅ pass	✅ pass	✅ pass	⚪ not_run	⚪ not_run	🛑 fail	2.7.0

Gate output details

sonarqube - spec compliance (🛑 fail)

Agent Plugins v1.0.0 manifest errors:
- manifest location is ".github/plugin/plugin.json"; expected "plugin.json" at plugin root
- $schema should be "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json"
- schema validation: manifest must have required property '$schema'

sonarqube - vally lint (✅ pass)

✅ sonar-analyze (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ sonar-coverage (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ sonar-dependency-risks (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ sonar-duplication (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ sonar-fix-issue (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ sonar-integrate (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ sonar-list-issues (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.

...output truncated...

sonarqube - install smoke test (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-8qzjRR/copilot-home/.copilot/installed-plugins/external-plugin-intake/sonarqube/.github/plugin/plugin.json.

sonarqube - version match (pass)

- 2.7.0: matched version "2.7.0" at ".github/plugin/plugin.json".

sonarqube - ref/sha consistency (not_run)

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

sonarqube - canvas structure (not_run)

Canvas structure gate skipped because plugin is not tagged with "canvas".

- sonarqube: spec=fail, vally-lint=pass, install-smoke=pass, version-match=pass, ref-sha-consistency=not_run, canvas-structure=not_run, overall=fail

[Copilot]

🟡 Changes recommended

The 2.7.0 release fails blocking external-plugin checks because its manifest location and schema declaration do not meet repository requirements.

1 open issue

• Fix plugin manifest location and schema compliance · New

What changed in this PR

Updates the existing SonarQube external plugin listing from 2.6.0 to 2.7.0, keeping source metadata and the generated marketplace entry aligned.

Changes:

• Bumps the plugin version to 2.7.0.
• Points both entries at the upstream 2.7.0 release tag.

File	Description
plugins/​external.json	Updates SonarQube’s version and source reference.
.github/​plugin/​marketplace.json	Mirrors the update in the generated marketplace.

_{Review effort: Max}