SONARJAVA-6211 Upload artifacts if ruling or autoscan fails

[tomasz-tylenda-sonarsource]

To help understand the problem we upload:

• raw actual results
• html diff
  Test run with intentionally broken ruling: https://github.com/SonarSource/sonar-java/actions/runs/23587514988

[hashicorp-vault-sonar-prod]

SONARJAVA-6211

[sonar-review-alpha]

Summary

Adds a reusable GitHub Action that uploads integration test artifacts and generates an HTML diff report when ruling or autoscan tests fail. This helps developers debug test failures by providing a visual side-by-side comparison of expected vs actual results without needing to run tests locally. The action is then integrated into the CI workflow for both ruling and autoscan jobs.

What reviewers should know

The core logic is in the new .github/actions/upload-actual/action.yml — it's a composite action with three steps: upload raw actual results, generate a diff using Unix diff and diff2html-cli, then upload the HTML report. The build.yml changes are simple applications of this action to the ruling and autoscan jobs, both guarded by if: failure() so they only run when tests fail. Note that diff2html-cli is invoked via npx (requires npm/Node at runtime), and artifacts are retained for 7 days. The action is parameterized to handle different directory structures for ruling vs autoscan.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[asya-vorobeva]

Generally looks OK. Probably makes sense to upload also artifacts for autoscan tests. Or do it in another PR.

[asya-vorobeva]

I think it makes sense to configure this policy on repo level.

[tomasz-tylenda-sonarsource]

I don't have access to do this, but I moved the parameter to a global env in a shared action.

[sonar-review-alpha]

Conclusion: Clean, focused CI change. The three new steps work correctly together — the artifact names are safely namespaced by runner/profile, the || true on diff correctly absorbs its non-zero exit code when differences exist, and the if: failure() conditions are appropriate throughout.

🗣️ Give feedback

[tomasz-tylenda-sonarsource]

Generally looks OK. Probably makes sense to upload also artifacts for autoscan tests. Or do it in another PR.

Done. I extracted a shared action (which is good idea even with one usage).

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[asya-vorobeva]

💯