PREQ-5981 Skip release/sign Maven profiles when deploy is false

[matemoln]

Context

sonar-security uses PGP signing (-Psign) plus gh-action_azure-artifact-signing setup for jsign-maven-plugin. The Unit Tests job uses deploy: false but previously still received -Prelease,sign, causing unnecessary signing and jsign failures without Azure env vars.

Summary

• Gate -Prelease,sign (default/maintenance) and -Prelease (dogfood) on should_deploy() in build-maven/build.sh
• When deploy: false, Maven runs install with -Pcoverage only — same behaviour as shadow scans (no signing)
• Fixes sonar-security Unit Tests and Sonar Analysis failing after BUILD-11035 Azure signing migration (failed run)

Test plan

• shellspec spec/build-maven_spec.sh (33 examples)
• After release: confirm sonar-security Unit Tests job on master passes with existing deploy: false

Links

• Jira: https://sonarsource.atlassian.net/browse/PREQ-5981
• Slack: https://sonarsource.slack.com/archives/C0455GD6K8Q/p1779185354979139

[sonarqubecloud]

Agentic Analysis: Early Results

Agentic Analysis and Context Augmentation are available on your project. Here are some issues that could have been prevented. Follow the links to learn how to put them into action.

1 issue(s) found across 1 file(s):

Rule	File	Line	Message
shelldre:S1192	spec/build-maven_spec.sh	607	Define a constant instead of using the literal 'release' 4 times.

_{Analyzed by SonarQube Agentic Analysis in 2.3 s}

[hashicorp-vault-sonar-prod]

PREQ-5981

[Copilot]

Pull request overview

This PR updates the Maven build workflow logic so that -Prelease,sign (default/maintenance) and -Prelease (dogfood) are only enabled when should_deploy() is true, preventing signing steps from running in deploy: false scenarios (e.g., unit-test-only jobs).

Changes:

• Gate Maven release/sign profiles on should_deploy() instead of RUN_SHADOW_SCANS.
• Extend ShellSpec coverage to validate profiles are excluded when DEPLOY=false.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
build-maven/build.sh	Adjusts when -Prelease,sign / -Prelease profiles are appended to the Maven command.
spec/build-maven_spec.sh	Updates and adds tests for the new deploy-gated profile behavior.

Comments suppressed due to low confidence (1)

build-maven/build.sh:174

• Same as above: avoid calling should_deploy a second time (it can emit warnings on shadow scans). Use the already-selected Maven goal (deploy vs install) to decide whether to add -Prelease.

    if should_deploy; then
      maven_command_args+=("-Prelease")
    fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Fixes the Unit Tests job in sonar-security by gating Maven release/sign profiles on the deploy flag, ensuring -Prelease,sign is skipped when deploy: false. All 33 shellspec tests pass with the corrected dogfood coverage assertion.

✅ 1 resolved

✅ Bug: Dogfood test asserts -Pcoverage but dogfood never gets it

📄 spec/build-maven_spec.sh:528-536 📄 spec/build-maven_spec.sh:514-526 📄 build-maven/build.sh:129-134 📄 build-maven/build.sh:158-160
The new test 'excludes release and sign profiles when DEPLOY is false' under is_dogfood_branch (line 533) asserts:

The output should include "Maven command: mvn install -Pcoverage"

However, should_scan() (build.sh:129-134) returns false for dogfood branches (it only covers default, maintenance, PR, and long-lived feature branches). Since -Pcoverage is only added when should_scan() is true (line 158-160), the dogfood Maven command will be mvn install without -Pcoverage.

The existing test at line 514-526 ('builds when DEPLOY is false') correctly shows mvn install without -Pcoverage for dogfood, confirming this.

This test should either be failing in CI, or there's a test setup detail I'm missing. Either way, the assertion should match the actual dogfood behavior.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}