Description

The sonar-cloud-quality-gate-status job in ci.yml polled SonarCloud with a fixed sleep 30 then a single curl to qualitygates/project_status. On cherry-pick branches SonarCloud frequently has not finished ingesting the analysis by the 30 s mark, so the API returns NONE/empty status and the job exits 1 — turning the required Check all jobs pass gate red for a timing reason entirely unrelated to code quality.

Root cause verified from INFRA-3671 analysis: PR 30969 (SHA e86a4f4) shows run 26844267240 quality-gate = failure with analysis green, and same-SHA run 26844272597 = success on re-run. This pattern appeared across ~20 of 48 gate-fail PRs in a 100-PR Runway cherry-pick sample (2026-03-04 → 2026-06-03), making SonarCloud the single largest driver of blocked auto-merges.

Fix: replace the single shot with a bounded retry loop — up to 12 attempts × 15 s = ≤3 min total. OK/ERROR exit immediately; any other status (ingestion still in progress) retries. After all attempts exhausted, the job fails (we do not pass-with-warning on Sonar unavailability).

Changelog

CHANGELOG entry: null

Related issues

Fixes: INFRA-3671 (WI-1 — SonarCloud quality-gate poll race)

Manual testing steps

Feature: SonarCloud quality gate on cherry-pick PRs

  Scenario: Runway cherry-pick PR reaches all-green without manual re-run
    Given a Runway cherry-pick PR targeting a release/* branch
    When the CI run completes
    Then sonar-cloud-quality-gate-status succeeds on first attempt
      (no need to manually re-trigger the job)
    And Check all jobs pass turns green without intervention

CI verification: observe the next Runway cherry-pick PR — the sonar-cloud-quality-gate-status job log should show attempt 1/12 (or similar) and succeed without a second run.

Screenshots/Recordings

Before

sonar-cloud-quality-gate-status exits 1 on first run ("Could not determine Quality Gate status"), requires manual re-run to turn green.

After

Job polls up to 12 × 15 s, succeeds as soon as SonarCloud ingestion completes.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable — N/A (CI workflow shell change; verified with actionlint and a YAML parse + structure assertion test)
• I've documented my code using JSDoc format if applicable — N/A
• I've applied the right labels on the PR (see labeling guidelines).

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.