ci(code-quality): skip cleanly when unconfigured, fail only when dispatched

[eaitbrahim]

Why it's failing

Exactly what the job was written to report:

Missing: SONAR_TOKEN SNYK_TOKEN
##[error]Process completed with exit code 1

Neither secret exists at repo or org level (gh secret list is empty in both), so the preflight exits 1 and both scans are skipped. Nothing is broken in the code — the workflow is correctly telling us it isn't configured. It has failed on every merge since #272 added the push trigger.

Why that answer stopped being right

Failing loudly was correct when this ran weekly and on dispatch: an unconfigured repo produced one red X a week, and the message named the missing secrets rather than letting Sonar and Snyk fail with their own unhelpful auth errors.

With push: [main], the same behaviour makes main permanently red for a condition that is not a defect. A red X on every merge is worse than a missing scan — it's a signal the reader learns to ignore, and it hides the next real failure.

What changes

The preflight now reports rather than decides, and who asked determines the verdict:

trigger	tokens missing	outcome
workflow_dispatch	yes	Fails, loudly — unchanged. Silently ignoring a direct request is worse.
push / schedule	yes	Skips both scans, writes the missing secrets and where to get them to the run summary, emits a ::notice. Build stays green.
either	no	Scans run normally.

The scan jobs are gated on a configured output rather than a job-level condition, because secrets can't be referenced from a job-level if:.

The skip is announced, never silent — the same standard this repo already holds discovery to. A scan that didn't run and says so is honest; one that quietly does nothing isn't.

Verified

Ran the preflight script directly in all three states:

• push, no tokens → exit 0, configured=false, summary renders correctly
• dispatch, no tokens → exit 1
• tokens present → exit 0, configured=true

This does not add the secrets

That's still yours to do, and it's the real fix — these scans have never run. Once SONAR_TOKEN and SNYK_TOKEN exist, the scans execute and none of the above applies.

🤖 Generated with Claude Code