[hermes] soteria #291: sonarqube_go_parse_failure #7

New Issue

bstein · 2026-08-12T21:14:38Z

bstein commented

2026-08-12 21:14:38 +00:00

Hermes auto-triage classified incident soteria/291 as sonarqube_go_parse_failure (confidence 0.78); first failed gate: sonarqube.

Why a human is needed

The build reached its agent and completed evidence collection, but SonarQube's Go analyzer failed to parse internal/server/policy_runtime.go when its parser subprocess exited with status 2. No failed test or assertion was published. A maintainer should inspect that file at revision 47205db5b2 and reproduce analysis with the pipeline's SonarQube toolchain to determine whether recent Go syntax is unsupported or the analyzer is defective. The actual per-check output from the enforcement stage is absent from this truncated bundle, so that evidence is needed before choosing between changing the Go source and updating the analysis toolchain.

Ariadne did not authorize automated remediation: human_required.

Facts

jenkins — Jenkins reported build 291 as FAILURE and identified "Enforce quality gate" as the first failed pipeline stage. (jenkins.result; jenkins.first_failed_stage)
jenkins — The structured failed-test collection is empty, so Jenkins did not publish evidence of a failing test case or assertion. (jenkins.failed_tests)
jenkins — During SonarQube analysis, the Go analyzer could not parse internal/server/policy_runtime.go because its external parser process exited with status 2. (jenkins.console_failures line 291)
jenkins — The scanner also could not execute Node.js, but it reported no JavaScript or TypeScript input files and completed that sensor, making this secondary to the Go parsing error. (jenkins.console_failures lines 291 and 345)
jenkins — After the quality-gate failure, Jenkins skipped the image build-and-push stage and ended with script exit code 1. (jenkins.console_tail)
opensearch — The correlated cluster log shows the Jenkins agent being set up successfully, with no supplied evidence of agent provisioning failure. (log_evidence.records[0] at 2026-08-12T20:59:09.287Z)

Evidence

The earliest failure region of the build console:

tty: true
    volumeMounts:
    - mountPath: "/home/jenkins/agent"
      name: "workspace-volume"
  - command:
    - "cat"
    image: "registry.bstein.dev/bstein/quality-tools:sonar8.0.1-trivy0.70.0-db20260422-arm64"
    name: "quality-tools"
    tty: true
    volumeMounts:
    - mountPath: "/home/jenkins/agent"
      name: "workspace-volume"
  - env:
    - name: "JENKINS_SECRET"
      value: "********"
    - name: "JENKINS_TUNNEL"
      value: "jenkins.jenkins.svc.cluster.local:50000"
    - name: "JENKINS_AGENT_NAME"
      value: "soteria-291-g73w8-5f54x-8nhmb"

Inferences

The first concrete failure capable of invalidating an enforced gate is the SonarQube Go-analysis failure on internal/server/policy_runtime.go, so the first failed gate was most likely the SonarQube gate rather than a test gate.
The missing Node.js executable appears to be non-blocking noise because the scanner found no JavaScript or TypeScript inputs and continued after that sensor.
The bundle does not include the individual check output from the Enforce quality gate stage, so it cannot prove whether the Go parser error directly failed the gate or whether a later, unshown SonarQube result did. Determining whether the source contains unsupported Go syntax or the analyzer itse...

Links

Failed build: https://ci.bstein.dev/job/soteria/291/
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_f6499b0e4b8e4b9595b665d7f1d23fc3). Hermes has no write access to this repository; no files or infrastructure were changed.

Hermes auto-triage classified incident `soteria/291` as **sonarqube_go_parse_failure** (confidence 0.78); first failed gate: `sonarqube`. ## Why a human is needed The build reached its agent and completed evidence collection, but SonarQube's Go analyzer failed to parse internal/server/policy_runtime.go when its parser subprocess exited with status 2. No failed test or assertion was published. A maintainer should inspect that file at revision 47205db5b2e8041bac6a06a78f94fd3662134fc8 and reproduce analysis with the pipeline's SonarQube toolchain to determine whether recent Go syntax is unsupported or the analyzer is defective. The actual per-check output from the enforcement stage is absent from this truncated bundle, so that evidence is needed before choosing between changing the Go source and updating the analysis toolchain. Ariadne did not authorize automated remediation: `human_required`. ## Facts - **jenkins** — Jenkins reported build 291 as FAILURE and identified "Enforce quality gate" as the first failed pipeline stage. (`jenkins.result; jenkins.first_failed_stage`) - **jenkins** — The structured failed-test collection is empty, so Jenkins did not publish evidence of a failing test case or assertion. (`jenkins.failed_tests`) - **jenkins** — During SonarQube analysis, the Go analyzer could not parse internal/server/policy_runtime.go because its external parser process exited with status 2. (`jenkins.console_failures line 291`) - **jenkins** — The scanner also could not execute Node.js, but it reported no JavaScript or TypeScript input files and completed that sensor, making this secondary to the Go parsing error. (`jenkins.console_failures lines 291 and 345`) - **jenkins** — After the quality-gate failure, Jenkins skipped the image build-and-push stage and ended with script exit code 1. (`jenkins.console_tail`) - **opensearch** — The correlated cluster log shows the Jenkins agent being set up successfully, with no supplied evidence of agent provisioning failure. (`log_evidence.records[0] at 2026-08-12T20:59:09.287Z`) ## Evidence The earliest failure region of the build console: ``` tty: true volumeMounts: - mountPath: "/home/jenkins/agent" name: "workspace-volume" - command: - "cat" image: "registry.bstein.dev/bstein/quality-tools:sonar8.0.1-trivy0.70.0-db20260422-arm64" name: "quality-tools" tty: true volumeMounts: - mountPath: "/home/jenkins/agent" name: "workspace-volume" - env: - name: "JENKINS_SECRET" value: "********" - name: "JENKINS_TUNNEL" value: "jenkins.jenkins.svc.cluster.local:50000" - name: "JENKINS_AGENT_NAME" value: "soteria-291-g73w8-5f54x-8nhmb" ``` ## Inferences - The first concrete failure capable of invalidating an enforced gate is the SonarQube Go-analysis failure on internal/server/policy_runtime.go, so the first failed gate was most likely the SonarQube gate rather than a test gate. - The missing Node.js executable appears to be non-blocking noise because the scanner found no JavaScript or TypeScript inputs and continued after that sensor. - The bundle does not include the individual check output from the Enforce quality gate stage, so it cannot prove whether the Go parser error directly failed the gate or whether a later, unshown SonarQube result did. Determining whether the source contains unsupported Go syntax or the analyzer itse... ## Links - Failed build: https://ci.bstein.dev/job/soteria/291/ - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_f6499b0e4b8e4b9595b665d7f1d23fc3](https://triage.hermes.bstein.dev/chat?resume=run_f6499b0e4b8e4b9595b665d7f1d23fc3)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/soteria#7