5348 sonar qube pr problem

[ToreMerkely]

• Added hard coded test for sonarqube PR scan to reproduce error server/#5348
• Fixed problem and change to use kosli attest sonar for test

[claude]

Claude finished @ToreMerkely's task in 2m 38s —— View job

---

PR Review: #780 — SonarQube PR Scan Fix

• Run static analysis (build, vet, mod tidy)
• Read and review changed files
• Post review findings

---

Static Analysis

All checks pass: go build ./..., go vet ./..., go mod tidy — no issues.

---

Summary

This PR fixes SonarQube PR scan support (server/#5348) by:

1. Detecting pull request scans from CE task data and routing to a new GetPRAnalysisData function that uses the project_pull_requests/list API
2. Adding a --sonar-ce-task-url flag for CI environments without filesystem access to report-task.txt
3. Fixing use-before-error-check on http.NewRequest results across all sonar functions
4. Adding missing defer Body.Close() in GetProjectAnalysisFromAnalysisID
5. Fixing comment accuracy and updating test fixture documentation

The core fix is well-structured — the PR/branch detection in GetCETaskData (lines 354-363) cleanly routes to the appropriate downstream function.

---

Issues

Pre-existing: Response body leaks (not introduced by this PR)

Three functions still have response body close issues. These are pre-existing but worth cleaning up since the file is already being improved:

1. GetCETaskData retry loop (lines 289-327): When task status is PENDING/IN_PROGRESS, taskResponse.Body is never closed before the next iteration. Each retry leaks an open body. The break path closes it, but the retry path doesn't. Add taskResponse.Body.Close() after decoding in each iteration.

2. GetQualityGate (line 509): qualityGateResponse.Body is never closed. Add defer func() { _ = qualityGateResponse.Body.Close() }() after the httpClient.Do call, matching the pattern in GetPRAnalysisData.

3. GetTaskID (lines 552-581): Body is closed manually at the bottom (line 578) but not via defer, so the decode error path on line 560 leaks. Switch to defer and remove the manual close.

Fix all three body close issues →

Nit: GetProjectAnalysisFromRevision also missing body close on error paths

GetProjectAnalysisFromRevision (line 407) closes the body manually at the end, but early returns from the decode error (line 389) and error check (line 401) skip the close. The defer pattern would be safer here too.

---

What's Good

• Clean PR/branch detection: The PullRequest field handling in GetCETaskData (lines 354-363) correctly prioritizes PR over branch, with explicit nil-ing of the alternative field.
• New GetPRAnalysisData function (lines 460-496): Well-structured, uses defer for body close, checks for API errors before iterating, and has a clear "not found" error message. This is the best body-close pattern in this file.
• Thorough documentation: The long description clearly explains all three methods, with the method-2 limitation called out. The updated update-sonarqube-test-data.txt with PR fixture instructions is a nice touch.
• --sonar-ce-task-url flag: Good addition for container-isolated CI environments. The server URL extraction from the CE task URL (lines 183-187) is clean.
• Consistent error-check fixes: All five http.NewRequest use-before-error-check bugs are fixed consistently.
• Test coverage: Two new test cases exercise both the PR scan path and the new --sonar-ce-task-url flag.

---