[nils-werner-sonarsource]

Problem

update-analyzer/action.yml still branches on SC-* ticket keys to target sonarcloud-core and its private/edition-sonarcloud/build.gradle. That branch is unreachable: SQC integration moved to sonar-plugins-deployer in a prior change, and automated-release.yml's update-analyzers job now only calls update-analyzer with the SQS ticket key — the SQC step calls update-plugins-deployer instead. Dead code left in an action that validates its own inputs is misleading to anyone reading the ticket-key description or error message.

Approach

Favor the smallest diff that fully removes the dead branch and keeps docs/tests truthful to the new behavior.

Question	Decision
Remove plugin-artifacts-sqc input from automated-release.yml too?	No — checked GitHub org-wide; 13 active caller repos (sonar-java, sonar-php, sonar-dotnet-enterprise, etc.) still pass this input to the reusable workflow. Removing it would break their next release run (reusable workflows reject unknown inputs). It belongs to automated-release.yml, not update-analyzer, and is out of scope here.
How to handle the test-update-analyzer.yml "Test Valid SC Ticket" step?	Repurposed into "Test SC Ticket Now Rejected" with an explicit pass/fail assertion, mirroring the existing invalid-ticket-format test, instead of silently leaving a step whose name no longer matches its expected outcome.
Scope of README updates	Full sync: description, ticket-key row, usage example, Notes, and Error Handling bullets — rather than leaving stale mentions of sonarcloud-core as "historical context" that would confuse a future reader.
Error message wording	Minimal: "Invalid ticket format. Must start with SONAR-." — no added explanation of why SC- was removed, consistent with how the branch itself is just deleted without a deprecation comment.

Implementation

update-analyzer/action.yml: removed the elif [[ "$TICKET_KEY" == SC-* ]] branch and its sonarcloud-core env vars, updated the error message and ticket-key/action descriptions. update-analyzer/README.md: dropped all SC-/sonarcloud-core mentions to match. .github/workflows/test-update-analyzer.yml: repurposed the SC-ticket test to assert rejection. No new abstractions or dependencies.

Tests

• Ticket-key validation: SONAR-* still accepted (unchanged), SC-* now explicitly asserted as rejected (previously just asserted it didn't error, though vault-less CI already masked that).
• Existing INVALID-123 invalid-format test continues to cover the generic non-SONAR- rejection path.

Test plan

• YAML syntax validated for update-analyzer/action.yml and .github/workflows/test-update-analyzer.yml (python3 -c "import yaml; yaml.safe_load(...)")
• actionlint run on the test workflow file — clean
• Grepped repo for remaining SC-/sonarcloud-core references in touched files — only the intentional rejection-test fixture remains
• Confirmed via GitHub code search that no caller repo passes an SC- ticket key to update-analyzer anymore (only update-plugins-deployer handles SQC now)

[hashicorp-vault-sonar-prod]

GHA-353

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved

Removes unreachable sonarcloud-core logic from the update-analyzer action and updates documentation and validation tests to reflect the new ticket-key requirements. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}