SONARJAVA-6231 Set up orchestrator cache

[tomasz-tylenda-sonarsource]

• The objective is to reduce Repox usage, where SQ downloads are one of the biggest drivers.
• We cache SQ downloaded by the orchestrator, unless the version is DEV. In future we may run against DEV only in the nightly build.
• The key depends on the week number, so it will be purged weekly.
• Inspired by https://github.com/SonarSource/SonarJS/blob/master/.github/actions/orchestrator-cache/action.yml
• Test: run the PR through a CI a few times: https://github.com/SonarSource/sonar-java/actions/workflows/build.yml?query=branch%3Att%2Fcache

[hashicorp-vault-sonar-prod]

SONARJAVA-6231

[sonar-review-alpha]

Summary

Adds caching for the SonarQube orchestrator downloads to reduce Repox usage. Introduces a reusable GitHub Action that caches the orchestrator directory using a week-based key (which auto-purges weekly), skips caching for DEV versions, and integrates it into the ruling QA and plugin QA jobs. Also adds a manual cleanup workflow for cache management.

What reviewers should know

Where to focus: Start with the new orchestrator-cache/action.yml to understand the caching strategy—note the week-based key (%Y-%U) ensures automatic weekly purges without staleness issues, and the if: inputs.sq-version != 'DEV' guard prevents caching development builds. Then review how it's integrated into build.yml—the action is called in both QA jobs before the mvn runs. The sq_version matrix variable replaced the hardcoded LATEST_RELEASE to support future flexibility.

Non-obvious: The cache key includes github.run_id for uniqueness, then falls back to restore-keys with just the version and week prefix—this is intentional GitHub Actions cache behavior. The cleanup workflow is separate and manual-only (workflow_dispatch), giving operators control over when to clean.

Watch for: This assumes the ORCHESTRATOR_HOME directory exists before SQ downloads—the action creates it with mkdir -p, so the flow is: create dir → restore cache (or skip if empty) → run tests (which populate it if needed). The matrix change adds sq_version: LATEST_RELEASE to all four test combinations, so caching is applied uniformly.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

Clean, focused implementation. The cache action is correctly wired into both QA jobs, the DEV bypass works as intended, and the weekly key rotation is a sound strategy for keeping cache fresh without manual intervention.

🗣️ Give feedback