ci(sonar): treat exit-1 (issues found) as scan success, not job failure

The CLI's three-state exit codes are part of its contract: 0=clean,
1=issues found (normal), 2+=tool error. GitHub Actions' default
'bash -e' shell propagated exit 1 from a healthy scan as a step
failure — masking the 'job ran but found things' signal we actually
want, and breaking the workflow on the very first run that found any
issue.

Fix: capture rc with set+e/set-e, fail the step only on rc>=2 (real
tool error). The Quality gate step (still informational) keeps the
'should we block on the findings themselves?' decision, decoupled from
'did the scanner run?'.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: aksOps

.github/workflows/sonar.yml

@@ -73,13 +73,30 @@ jobs:
       # XMLs are passed in as coverage evidence — one per Java module that
       # produces coverage. agent-scan writes JSON to .sonar-predictor/scan.json
       # and prints a human summary on stdout; we want both.
+      #
+      # IMPORTANT: the CLI uses three-state exit codes
+      #   0 = clean (no findings at the floor)
+      #   1 = issues found (a normal scan outcome, not a failure)
+      #   2 = tool error (broken input, daemon unreachable, no Java)
+      # Step success means "the scanner ran". Whether the *result* should
+      # fail the build is decided by the Quality gate step below. We must
+      # not let `bash -e` propagate exit-1 from a healthy scan as a job
+      # failure; we propagate exit code only when it's >= 2.
       - name: Run self-scan
         run: |
+          set +e
           export SONAR_PREDICTOR_HOME="$(pwd)/dist/target/skill/sonar-predictor"
           ./plugin/skills/sonar-predictor/bin/sonar agent-scan analyze . \
             --coverage protocol/target/site/jacoco/jacoco.xml \
             --coverage daemon/target/site/jacoco/jacoco.xml \
             --coverage cli/target/site/jacoco/jacoco.xml
+          rc=$?
+          set -e
+          echo "Self-scan exit code: $rc (0=clean, 1=issues found, 2+=tool error)"
+          if [ "$rc" -ge 2 ]; then
+            echo "::error::Self-scan tool error (exit $rc) — see step log."
+            exit "$rc"
+          fi
 
       # Render headline counts into the GitHub job summary so reviewers see
       # the scan result inline on the run page without downloading artifacts.