test(sonarqube): remove 26.5.0 web-layer agent + webapp override to isolate 26.7 search regression (?v=4)

[emmanuelbruno]

Diagnostic experiment: isolate SonarQube 26.7 empty-project-list regression

Root-cause hypothesis: server is 26.7.0 but the community-branch-plugin web-layer artifacts are pinned at 26.5.0 (the sonar.web.javaAdditionalOpts ... =web javaagent + the sonarqube-webapp.zip init-container override that mounts over /opt/sonarqube/web). A 26.5.0 web agent predates the 26.7 UUID / auth_<uuid> shadow-doc search model, so search_projects returns the right total but an empty components[].

This change removes ONLY the web-layer artifacts to test whether the project list populates:

• helm/releases/sonarqube/values.yaml
  • removed the extraInitContainers (download-webapp / webapp.zip) block
  • removed the extraVolumeMounts (/opt/sonarqube/web) block
  • removed the extraVolumes (webapp emptyDir) block
  • removed sonar.web.javaAdditionalOpts ... =web
  • CE-side config intentionally UNCHANGED (plugin jar install URL + sonar.ce.javaAdditionalOpts ... =ce)
• bootstrap/appset-helm.yaml
  • sonarqube valueURL cache-buster ?v=3 -> ?v=4 (required so ArgoCD re-renders the remote values)

Operational impact

• Merging triggers ArgoCD auto-sync (selfHeal + prune) → SonarQube StatefulSet rolls → brief pod restart, ~2-5 min team outage.
• Fully reversible: revert this commit and bump ?v again to restore the 26.5.0 web-layer artifacts.

Verification

• GET /api/components/search_projects (header Gap-Auth: admin) should return a non-empty components[] (15 projects) after the pod comes back.
• If still empty → the web agent was not the cause; next step is to also revert (restore) and investigate CE-side / search resolver.

[Copilot]

🔵 Needs a closer look

The change triggers a rollout and brief service outage, requiring human review.

Pull request overview

This diagnostic PR removes SonarQube 26.5 web-layer overrides to isolate a 26.7 project-search regression.

Changes:

• Removes webapp downloads, mounts, and the web javaagent.
• Preserves CE-side plugin configuration.
• Bumps the ArgoCD values cache-buster from v=3 to v=4.

File summaries

File	Description
helm/releases/sonarqube/values.yaml	Removes web-layer plugin artifacts.
bootstrap/appset-helm.yaml	Forces ArgoCD to reload updated values.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.