ci: pin ddk-target into the scoped reactor and gate on report presence

The target-definition artifact is referenced by target-platform-
configuration, not by any bundle MANIFEST, so -am never pulls
ddk-target into a scoped reactor. Tycho then falls back to the
local-repository copy of the .target, which fails on a cold cache and
— worse — silently resolves a stale target definition on a warm one
(verified: a June install of the sequenceNumber-29 target still
pointed at the 2026-03 release train while the tree's points at
2026-06). The scope script now always prepends ../ddk-target to the
-pl list, so the current target definition always comes from the
reactor.

The gate additionally verifies that every scanned module produced its
SARIF (and that a full scan produced any at all): --fail-never
swallows even target-resolution failures, so without a presence check
a dead build uploads nothing and counts zero violations — a vacuous
green.

Verified locally against a repository with no installed ddk-target:
the previous flags reproduce the resolution failure with zero SARIFs;
the pinned reactor analyses the changed module in 34s and resolves the
current platform (jdt.core 3.46.0, not the stale 3.45.0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: joaodinissf

.github/scripts/compute-spotbugs-skip.sh

@@ -34,6 +34,9 @@ while IFS= read -r f; do
   case "$f" in
     pom.xml | ddk-parent/* | .mvn/* | *.target | .github/* | *[Ss]pot[Bb]ugs*[Ee]xclude*)
       echo "Build/config change ($f) -> full SpotBugs scan (no skips)."
+      if [ -n "${GITHUB_ENV:-}" ]; then
+        echo "SPOTBUGS_FULL_SCAN=true" >> "$GITHUB_ENV"
+      fi
       exit 0
       ;;
   esac
@@ -64,15 +67,21 @@ inject_skip() {
   rm -f "$pom.bak"
 }
 
-# 5) Skip every reactor module that was not touched by this PR.
+# 5) Skip every reactor module that was not touched by this PR. Kept modules with a
+#    bundle MANIFEST are expected to produce an analysis report — the gate checks this
+#    so a swallowed resolution/compile failure can never pass as "nothing to scan".
 kept=0
 skipped=0
 kept_pl=""
+expect_reports=""
 while IFS= read -r mod; do
   [ -n "$mod" ] || continue
   if printf '%s\n' "${changed_mods}" | grep -qx "$mod"; then
     kept=$((kept + 1))
     kept_pl="${kept_pl:+${kept_pl},}../${mod}"
+    if [ -f "${mod}/META-INF/MANIFEST.MF" ]; then
+      expect_reports="${expect_reports:+${expect_reports} }${mod}"
+    fi
   else
     inject_skip "$mod"
     skipped=$((skipped + 1))
@@ -81,11 +90,16 @@ done <<EOF
 ${module_dirs}
 EOF
 
-# 6) Scope the reactor to the changed modules + their upstream dependencies. With no
-#    changed reactor module (e.g. a docs-only PR) the full reactor builds with every
-#    analysis skipped — same result, no flags needed.
+# 6) Scope the reactor to the changed modules + their upstream dependencies. ddk-target
+#    is always kept in the -pl list: the target-definition artifact is referenced by
+#    target-platform-configuration, not by any MANIFEST, so -am never pulls it — without
+#    it in the reactor Tycho falls back to a local-repository copy, which fails on a
+#    cold cache and can silently resolve a stale target definition on a warm one.
+#    With no changed reactor module (e.g. a docs-only PR) the full reactor builds with
+#    every analysis skipped — same result, no flags needed.
 if [ "$kept" -gt 0 ] && [ -n "${GITHUB_ENV:-}" ]; then
-  echo "SPOTBUGS_SCOPE_ARGS=-pl ${kept_pl} -am" >> "$GITHUB_ENV"
+  echo "SPOTBUGS_SCOPE_ARGS=-pl ../ddk-target,${kept_pl} -am" >> "$GITHUB_ENV"
+  echo "SPOTBUGS_EXPECT_REPORTS=${expect_reports}" >> "$GITHUB_ENV"
 fi
 
 echo "SpotBugs scope: scanning ${kept} changed module(s), skipping ${skipped} unchanged."

.github/workflows/verify.yml

@@ -179,8 +179,22 @@ jobs:
           fi
 
       - name: Gate on SpotBugs violations
+        # Presence checks close the vacuous-green hole: --fail-never swallows even
+        # target-platform resolution failures, so "no SARIF produced" must only ever
+        # mean "every module was skip-injected", never "the build silently died".
         run: |
           set -eu
+          for mod in ${SPOTBUGS_EXPECT_REPORTS:-}; do
+            if [ ! -s "${mod}/target/spotbugsSarif.json" ]; then
+              echo "::error::${mod} was scanned but produced no SpotBugs SARIF — a build failure was swallowed by --fail-never."
+              exit 1
+            fi
+          done
+          if [ "${SPOTBUGS_FULL_SCAN:-}" = "true" ] && \
+             [ "$(find . -path '*/target/spotbugsSarif.json' | wc -l)" -eq 0 ]; then
+            echo "::error::Full scan produced no SpotBugs SARIFs — a build failure was swallowed by --fail-never."
+            exit 1
+          fi
           sb_total=$(jq '[.runs[].results[]?] | length' .sarif-merged/spotbugs.sarif 2>/dev/null || echo 0)
           echo "SpotBugs SARIF violations: $sb_total"
           if [ "$sb_total" != "0" ]; then