From 78567aab5fc498cf7f1495670d9891712cf82709 Mon Sep 17 00:00:00 2001
From: James Gunn <james@gunn.io>
Date: Thu, 13 Aug 2026 09:15:46 +0100
Subject: [PATCH] sonarscan-dotnet: let SonarScanner provision its own JRE

The action hardcoded sonar.scanner.skipJreProvisioning=true and installed
Java 17, so the scanner engine was pinned to whatever JDK the action chose.
SonarQube Cloud has since raised its minimum to Java 21, and the engine now
dies on startup. The scanner reports this as a broken stdin pipe and aborts
with exit code 134, which gives no hint that Java is the cause.

Make the flag configurable via a new skip-jre-provisioning input, defaulting
to false so the scanner downloads the JRE the server asks for and tracks
future bumps on its own. Raise the java-version default to 21 for consumers
that opt back into skipping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 sonarscan-dotnet/README.md   | 35 ++++++++++++++++++++++++++++++++++-
 sonarscan-dotnet/action.yaml | 23 ++++++++++++++++++++---
 2 files changed, 54 insertions(+), 4 deletions(-)

diff --git a/sonarscan-dotnet/README.md b/sonarscan-dotnet/README.md
index d5412b8..a73ea3c 100644
--- a/sonarscan-dotnet/README.md
+++ b/sonarscan-dotnet/README.md
@@ -26,7 +26,8 @@ It:
 - `dotnet-version`: .NET SDK version used when not using global.json
 - `dotnet-tool-restore`: Runs `dotnet tool restore` when true
 - `java-distribution`: Java distribution used by SonarScanner (e.g. zulu, temurin, microsoft) (Default: zulu)
-- `java-version`: Java version used by SonarScanner
+- `java-version`: Java version installed for SonarScanner (Default: 21)
+- `skip-jre-provisioning`: Stops SonarScanner downloading its own JRE (Default: false)
 - `sonarcloud-project-key`: SonarCloud project key
 - `sonarcloud-organisation`: SonarCloud organisation (Default: dfe-digital)
 - `sonarcloud-token`: SonarCloud authentication token
@@ -89,6 +90,38 @@ with:
   build-command: dotnet build YourSolution.sln --no-restore --no-incremental
 ```
 
+---
+
+## Java and JRE provisioning
+
+SonarScanner for .NET runs the analysis itself in a Java "scanner engine" during the
+`end` step. By default this action lets the scanner download the JRE that SonarQube Cloud
+currently requires, so the Java version tracks the server automatically.
+
+SonarQube Cloud raises its minimum Java version from time to time. When it does, a pinned
+local JDK below the new minimum causes the engine to fail on startup, which surfaces as an
+unhelpful error rather than a version message:
+
+```
+Unhandled exception. System.IO.IOException: Pipe is broken.
+   at SonarScanner.MSBuild.Shim.SonarEngineWrapper.Execute(...)
+##[error]Process completed with exit code 134
+```
+
+Set `skip-jre-provisioning: true` only on runners that cannot reach the JRE download. If
+you do, you own the Java version, and `java-version` must be at or above Sonar's current
+minimum:
+
+```yaml
+- name: SonarCloud scan
+  uses: DFE-Digital/github-actions/sonarscan-dotnet@master
+  with:
+    sonarcloud-project-key: your_project_key
+    sonarcloud-token: ${{ secrets.SONAR_TOKEN }}
+    skip-jre-provisioning: true
+    java-version: 21
+```
+
 ## Dependabot and SONAR_TOKEN
 
 SonarCloud analysis requires a valid `SONAR_TOKEN` to publish results.
diff --git a/sonarscan-dotnet/action.yaml b/sonarscan-dotnet/action.yaml
index 15cfcba..be503a8 100644
--- a/sonarscan-dotnet/action.yaml
+++ b/sonarscan-dotnet/action.yaml
@@ -32,9 +32,11 @@ inputs:
     default: "zulu"
 
   java-version:
-    description: "Java version used by SonarScanner."
+    description: >
+      Java version installed for SonarScanner. The scanner engine runs on it when
+      skip-jre-provisioning is true; otherwise the scanner provisions its own JRE.
     required: false
-    default: "17"
+    default: "21"
 
   sonarcloud-project-key:
     description: "SonarCloud project key."
@@ -54,6 +56,15 @@ inputs:
     required: false
     default: "https://sonarcloud.io"
 
+  skip-jre-provisioning:
+    description: >
+      If true, SonarScanner will not download its own JRE and will run on the JDK installed
+      by this action (see java-version). Set this only on runners that cannot reach the
+      SonarQube Cloud JRE download, and keep java-version at or above the version Sonar
+      currently requires.
+    required: false
+    default: "false"
+
   sonarscan-args:
     description: "Additional SonarScanner arguments."
     required: false
@@ -124,6 +135,12 @@ runs:
           COVERAGE_ARG=""
         fi
 
+        if [ "${{ inputs.skip-jre-provisioning }}" = "true" ]; then
+          JRE_ARG="/d:sonar.scanner.skipJreProvisioning=true"
+        else
+          JRE_ARG=""
+        fi
+
         dotnet tool run dotnet-sonarscanner begin \
           /o:"${{ inputs.sonarcloud-organisation }}" \
           /k:"${{ inputs.sonarcloud-project-key }}" \
@@ -131,7 +148,7 @@ runs:
           /d:sonar.token="$TOKEN" \
           ${COVERAGE_ARG} \
           /d:sonar.coverage.exclusions="${{ inputs.coverage-exclusions }}" \
-          /d:sonar.scanner.skipJreProvisioning=true \
+          ${JRE_ARG} \
           ${{ inputs.sonarscan-args }}
 
     - name: Build