RC-455 Keep 7-day retention for actual ruling artifacts

[romainbrenguier]

Follow-up to #6330: the shared prepare-ruling-artifact action uploaded actual_* artifacts with the repository default retention instead of the previous 7 days. This passes retention-days to it again.

The composite action upload-actual declared RETENTION_DAYS in a top-level env: block, which action metadata does not support, so ${{ env.RETENTION_DAYS }} resolved to an empty string. It is replaced by a retention-days input (default '7') used by both uploads. This also restores the 7-day retention for diff_* artifacts, which was silently broken before.

Merge after SonarSource/core-languages-tooling-public#77 (until it is merged, the input is ignored with an "Unexpected input" warning, since the action is referenced @master).

🤖 Generated with Claude Code

Agent workflow

Tool link: https://github.com/SonarSource/languages-experimental-tooling/tree/romain/my-tickets/personal/romain-brenguier
PR updated using uv run update_with_claude.py --prompt "Implement the action plan described in the document /tmp/action_plan_romain/RC-455-prepare-ruling-artifact.txt." -a "/tmp/action_plan_romain/RC-455-prepare-ruling-artifact.txt" -g "claude"

PR updated using uv run update_with_claude.py --prompt "Implement the action plan described in the document /tmp/action_plan_romain/RC-455-prepare-ruling-artifact.txt." -a "/tmp/action_plan_romain/RC-455-prepare-ruling-artifact.txt" -g "claude"

[hashicorp-vault-sonar-prod]

RC-455

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Setting ruling-artifact retention to seven days could make actual and diff results unavailable sooner than the repository default.

Restores 7-day retention for actual_* and diff_* ruling artifacts by replacing the unsupported top-level env: block in upload-actual with a retention-days input (default '7') used by both uploads. Resolved the finding that retention-days was ignored and received an empty value. No open issues found.

✅ 1 closed

✅ Cross-Repo: retention-days is ignored by prepare-ruling-artifact and also gets an empty value

📄 .github/actions/upload-actual/action.yml:28
Fix here and in SonarSource/core-languages-tooling-public

Breaks in: SonarSource/core-languages-tooling-public - prepare-ruling-artifact/action.yml - inputs / Upload ruling results step

In SonarSource/core-languages-tooling-public, prepare-ruling-artifact/action.yml on the default branch only declares the artifact-name input, and its "Upload ruling results" step sets no retention-days. The new input on line 28 is dropped with an "Unexpected input" warning, so actual_* artifacts keep the repository default retention until core-languages-tooling-public#77 is merged. The PR description already calls out this ordering, so this PR has to land after #77, not before.

Merging #77 is not enough by itself. Action metadata has no top-level env: key: the allowed keys are name, author, description, inputs, outputs, runs and branding (metadata syntax), and the runner ignores anything else (ActionManifestManager). That means the RETENTION_DAYS: 7 block at lines 18-19 never applies. ${{ env.RETENTION_DAYS }} only sees the caller's env, and .github/workflows/build.yml doesn't set it, so the sibling would receive an empty string and still use the default retention. The diff_* upload on line 54 has the same issue.

Here: Hold back the merge until core-languages-tooling-public#77 lands. Also replace ${{ env.RETENTION_DAYS }} with a value that actually resolves: hard-code 7, or add a retention-days input with default '7' and use ${{ inputs.retention-days }} here and on line 54. Then delete the unsupported top-level env: block.

There: In SonarSource/core-languages-tooling-public, merge #77. It declares a retention-days input in prepare-ruling-artifact/action.yml and forwards it to the upload-artifact call in the "Upload ruling results" step.

In SonarSource/core-languages-tooling-public - prepare-ruling-artifact/action.yml:

inputs:
  retention-days:
    description: Number of days to retain the artifact (empty = repository default)
    required: false
    default: ''
# ... in the Upload ruling results step:
      with:
        retention-days: ${{ inputs.retention-days }}

Verification Rules 2/2 met Repos 1 inspected · PRs 1 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries (artifactory_registries)
✅ Repository license compliance (license_compliance)

Broader impact Repos 1 inspected PRs 1 inspected

Cross-repo 1 repository inspected 0 open impacts

SonarSource/core-languages-tooling-public Inspected

Cross-PR 1 PR inspected 0 open impacts

PR #77: RC-455 Add retention-days input to prepare-ruling-artifact Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube