[Reefact]

Summary

Adds a monthly scheduled run to sonar.yml. SonarCloud deletes a token that goes 60 days without being used, and nothing guaranteed this one was used that often. That is what broke Sonar on #105. The schedule widens the margin but is not a guarantee: GitHub disables scheduled triggers in a public repository after 60 days without activity.

Type of change

• Build / CI / tooling

Changes

• sonar.yml gains schedule: cron '41 4 3 * *', which runs on the 3rd of each month at 04:41 UTC and analyses main. While the repository sees any activity, the longest gap between two analyses is about 31 days.
• The comment above the cron records why the schedule exists (the 2026-08-12 → 2026-10-31 gap, and Dependabot pull requests running without the secret), and also what it does not guarantee. In a repository with no activity, GitHub disables the scheduled trigger around day 60, so the token still lapses, between day 90 and day 120 instead of day 60. The comment gives the recovery steps and notes that an automatic keepalive would need actions: write.
• The job's if already admits scheduled runs, since it filters only pull_request events from forks. Nothing else changes.

Testing

• actionlint 1.7.7, with the version and checksum that ci.yml pins: nothing to report
• tools/commit-lint/lint-commit-message.sh on both commit messages: passes
• dotnet build -c Release / dotnet test -c Release: not run, no code changed
• tests/PackageSmokeTest/run.sh: not run, packaging untouched

The scheduled trigger itself cannot run before it reaches main. After merge, a workflow_dispatch run exercises the same job, and the first scheduled run is due on the 3rd.

Public API

• No change to the public surface

Documentation

• No documentation change required

🤖 Generated with Claude Code

https://claude.ai/code/session_019k6GsUrFe92DSgN3opCj6g

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T17:09:08.074427Z	93de72c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Reefact]

Review finding on scheduled workflow reliability.

[Reefact]

issue (blocking): PR title still promises a guarantee

The title, ci(sonar): run monthly so SONAR_TOKEN is never left unused, still claims the token can never become unused. The revised description and workflow comment correctly explain that GitHub can disable scheduled runs after 60 days without repository activity, so the token can still expire. Please change the title to something accurate, such as ci(sonar): reduce SONAR_TOKEN expiry risk with monthly runs. This is a contract/accuracy issue, not a wording preference.

[Reefact]

done: retitled to 'reduce SONAR_TOKEN expiry risk with monthly runs'

Answers issue (blocking): PR title still promises a guarantee. The finding is a review body, which has no thread to reply in, so the answer is here.

The title is now ci(sonar): reduce SONAR_TOKEN expiry risk with monthly runs, as you suggested. It now matches the description and the workflow comment: the schedule lowers the risk and guarantees nothing. This was a PR metadata change, so no commit was pushed.

One place still carries the old claim: the header of commit 93de72c, ci(sonar): run monthly so SONAR_TOKEN is never left unused. A merge that keeps the commits, as #105's did, would put that header on main. Fixing it means rewording the commit and force-pushing this branch. I have not done it; it is your call. A squash merge under the new title avoids it too.

---

Generated by Claude Code

[Reefact]

reviewed: the monthly Sonar schedule's limitations are now accurately documented

Verified the corrected PR title, description and .github/workflows/sonar.yml at 63ea56e. The original finding is addressed and its thread resolved. No further finding remains in this review. The original commit subject retains the earlier wording; squash merging under the updated title avoids bringing that wording to main.

This closes my review; it is not an approval.