fix(ci): scope SonarCloud scans to the canonical repository

[2160039878-cyber]

Description

A push inside a fork satisfies the existing SonarCloud condition, but sonar-project.properties targets the upstream project. A PR inside that fork also satisfies the same-repository condition. Both fail with HTTP 401 when the fork has no credentials for the upstream project, after the executable test/build jobs pass.

Limit the upstream-targeting job to libredb/libredb-studio, retaining the existing external-PR and Dependabot exclusions. Human pushes and same-repository PRs in the canonical repository still run the scan.

Type of Change

• Bug fix
• Test addition or update

Related Issue

Closes #732

Changes Made

• Add one repository predicate to the SonarCloud job condition, with its reason.
• Exercise the actual YAML condition in seven event/repository/actor cases. The human PR context uses a Dependabot-named branch to preserve the actor-based behavior introduced in ci: run SonarCloud only where SONAR_TOKEN can be read #397.

Testing

• Local regression: bun run test:unit --pass-with-no-tests -t 'SonarCloud workflow' went from 5 passed / 2 failed (fork push and fork-local PR) to 7 passed / 0 failed.
• Biome formatting and git diff --check passed.
• Full Linux CI succeeded on the exact PR commit 80a318b5f2b835780d4272490e3c8c999775ea46: all nine executable test/build jobs passed, including the unfiltered coverage run and 100% line-coverage gate, lint/typecheck/build, Helm, Node 24/26 engine smoke, channel E2E, browser/subpath E2E, and PostgreSQL functional smoke. SonarCloud is correctly skipped in this fork. The coverage run reports 14,720 passed, with all 392 core files and 34 component groups passing, and 46,324/46,324 lines covered (100%). Browser E2E reports 65 passed / 1 flaky (passed on retry) / 6 skipped under the existing configuration; subpath and PostgreSQL each pass 1 test, and tarball/npx each pass 3.
• Secret Scan passed on the same commit.

Full coverage, Helm checks, and E2E run in Linux CI because this Windows host has the previously observed SQLite cleanup EBUSY and an unavailable Docker Desktop daemon. The filtered local command is only the regression check; the CI coverage command is unfiltered.

Test Environment

LibreDB Studio 0.15.0; Bun 1.4.2; Windows local / Ubuntu CI; Node 24, with Node 26 engine smoke.

Checklist

• Opened the linked issue before editing and branched from main.
• Reviewed the diff and verified regression failures before the fix.
• No dependencies added; no provider changes, so the provider triad does not apply.

Additional Notes

AI-assisted implementation and validation using Codex, disclosed in the issue. This changes the scope of the upstream-specific scan; the executable test jobs, 100% coverage gate, scan failure behavior, and canonical-repository scans keep their existing requirements.

[cevheri]

Thanks, this reproduces exactly as described. Your fork run shows the nine executable jobs green and SonarCloud red with an empty SONAR_TOKEN and three 401s from sonarcloud.io, and the run on the PR commit shows the job skipped. On our side all 20 checks passed; the two skips are the usual Image Scan and SonarCloud for a fork PR.

I checked the guard the way I check any boolean gate. With main's ci.yml the fork push and fork-local PR rows fail and the other five pass. Each of the seven rows kills at least one mutation of the condition (dropping the actor guard, dropping the same-repo disjunct, turning the or into an and), so none of them is dead weight. Evaluating the expression itself instead of asserting its text is a good addition to the workflow tests we already have.

One optional tidy-up if you push again: the comment block above the condition still says "Two populations cannot read it" and the Forks bullet only covers fork pull requests. Folding fork-owned runs into that bullet would keep the block one story. Not required for merge.

I will merge this shortly.