ci: SonarCloud rejects the repository SONAR_TOKEN #75

Gap Claim

SonarCloud rejects the repository's SONAR_TOKEN, so the CI sonar job fails before any analysis. In run 37899310319 (PR #71, 2026-10-09) the secret is present (masked as ***), and the scanner stops at its first authenticated call:

07:30:24.827 ERROR Failed to query JRE metadata: GET https://api.sonarcloud.io/analysis/jres?os=linux&arch=x86_64 failed with HTTP 403 Forbidden. Please check the property sonar.token or the environment variable SONAR_TOKEN.
07:30:24.828 INFO  EXECUTION FAILURE

The same failure occurs in every non-Dependabot run since: PR #72 run 37899697212, PR #73 run 37902221136, PR #74 run 37902707941, and five workflow_dispatch runs (37901326740 to 37901782766).

The last successful scans were the dev push runs 34800634673 (b09ce23) and 34800652984 (b923768, the current dev head) on 2026-09-14. Both report "QUALITY GATE STATUS: PASSED".

Every pull request run between 2026-09-14 and 2026-10-09 came from Dependabot. ci.yml skips the scan step for Dependabot PRs ("SonarCloud credentials are unavailable to Dependabot pull requests."), so no run used the token in that period and nothing surfaced the rejection earlier.

Existing Surface Audit

• .github/workflows/ci.yml, job sonar: SonarSource/sonarqube-scan-action with SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}.
• sonar-project.properties: sonar.projectKey=Brad-Edwards_aces-scenario-workbench and sonar.organization=brad-edwards, unchanged since the successful 2026-09-14 scans.
• The 403 comes from the JRE-metadata endpoint, before the scanner loads any project setting, so it concerns the token itself, not the project key or the quality gate.

Alternatives

1. Change workflow or scanner configuration: rejected. Nothing in the repository changed between the passing and failing runs, and the error precedes project resolution.
2. Store a valid SonarCloud token in the repository secret SONAR_TOKEN (Settings → Secrets and variables → Actions): selected.

Chosen Architecture

Rotating the secret is a repository-settings action. No file in the repository changes.

Verification Plan

• Re-run the sonar job of any open pull request, such as ci: add an OpenSSF Scorecard workflow and README badge #71. The scanner should pass JRE provisioning and print a QUALITY GATE STATUS line.