[rmcdaniel]

Server's merge queue needs a genuine Sonar result on its synthetic commit. The existing policy only supports credentialed Sonar on PR/main and privileged workflow_run artifact consumers, so it correctly rejects the new queue scanner until its distinct trust boundary is represented.

Accept one exact static-analysis form: Server's queue-sonar.yml, completed PHPUnit merge-group runs, read-only permissions, GitHub-hosted runner, trusted controls from github.workflow_sha, validated candidate data in a separate directory, trusted preparation commands, and the centrally pinned scanner as the only token recipient. Any added command, credential scope, artifact/cache step, candidate-controlled controller, or changed scanner arguments fails closed. Existing artifact-consumer rules and ordinary Sonar rules remain unchanged.

Verification: the complete qualification-policy suite passes (21 tests), including 22 hostile workflow mutations and repository/filename boundaries. The real Server workflow validates against this policy; its 66 focused scanner/merge-group/aggregate contracts pass. Hosted CI and independent review remain required. Consumer implementation: durable-workflow/server#788.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
86.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General's maintainer review accepts exact head 3654ec73036681b96afc7485af89e69e8d4a628d, tree 911fd71196c74cdaf9cbe2470d7a657b620902be.

The policy adds one acceptance form for Server's new queue-sonar.yml. It requires the completed merge-group source event, read-only token permissions, trusted controls from github.workflow_sha, validated candidate identity, separate data checkout, the exact trusted preparation commands, and the centrally approved static scanner. The credential is confined to that scanner step. Linked source and submodules are rejected by the consumer, candidate scanner properties are replaced, automatic Clippy execution is disabled, and scanner output is outside candidate data. All other privileged-consumer and Sonar forms retain their existing validation.

Local qualification passes all 21 policy tests, including 23 hostile workflow mutations and wrong-repository/filename controls. The complete real Server workflow directory validates with this policy. All seven hosted checks on this exact head are successful, including Shared contract tests, CodeQL and Sonar App analysis.

This qualified policy prerequisite can land independently. Server #788 retains its own source qualification, CodeQL data-checkout classification and real synthetic-SHA analysis requirements before its consumer lands.