ci: retry SonarCloud scan once on transient failure

[yperbasis]

Problem

Two merge-queue evictions in the last 3 weeks were caused by the SonarCloud scan failing to download the scanner CLI from binaries.sonarsource.com — not by anything in the queued code:

• Jun 3 run: instant Unexpected HTTP response: 403 (the action does not retry 4xx) — evicted p2p/sentry: don't duplicate SendMessageById across shared-store sentries #21597 from the queue with all sibling jobs green or still running
• Jun 1 run: download kept failing through the action's three internal attempts (~40s), then gave up

In the merge queue the sonar job fast-cancels the whole CI Gate run on failure, so a CDN blip cancels ~40 min of green sibling jobs and github-merge-queue removes the PR with failed_checks. Per CI-GUIDELINES.md, merge-queue checks must have no false positives; CDN weather is one.

Fix

Give the scan one spaced retry:

• the first attempt runs with continue-on-error: true
• if it failed, wait 90s and run the action again
• if the retry also fails, the job fails as before — a persistent outage still blocks correctly

cache-warming-only runs are unaffected (scan skipped → outcome is skipped, so the retry steps skip too). A continue-on-error step reports conclusion: success to the jobs API, so ci-gate's root-cause detection won't flag a run recovered by the retry; a double failure is attributed to SonarCloud scan (retry).

Alternatives considered

• Pre-seeding the runner tool cache: impossible — the action's tc.find() lookup can never match SonarSource's 4-segment version string (semver.clean("8.1.0.6389") is null), so the action's internal tool-cache path is dead code on any runner.
• Mirroring the scanner zip via scannerBinariesUrl: removes the CDN dependency entirely but adds hosting and per-upgrade maintenance, and the GPG keyserver dependency remains. Can revisit if 403s persist despite the retry.

No tests: CI workflow YAML change (TDD not applicable); validated with actionlint and make lint.

[Copilot]

Pull request overview

This PR updates the SonarCloud GitHub Actions workflow to reduce merge-queue false positives caused by transient external download/service failures during the Sonar scan.

Changes:

• Runs the first SonarCloud scan attempt with continue-on-error: true and captures its outcome via a step id.
• If the first attempt fails, waits 90 seconds and retries the SonarCloud scan once.
• Keeps existing behavior for persistent failures (the job still fails if the retry fails) and leaves cache-warming-only runs unaffected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.