# 401 during GH workflow of Gradle sonar task with SonarCloud

**URL:** <https://community.sonarsource.com/t/401-during-gh-workflow-of-gradle-sonar-task-with-sonarcloud/132159>\
**Category:** SonarQube Cloud\
**Tags:** gradle\
**Created:** [December 13, 2024, 6:27pm UTC](https://community.sonarsource.com/t/401-during-gh-workflow-of-gradle-sonar-task-with-sonarcloud/132159 "2024-12-13T18:27:34Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [December 19, 2024, 12:43pm UTC](https://community.sonarsource.com/t/401-during-gh-workflow-of-gradle-sonar-task-with-sonarcloud/132159/7 "2024-12-19T12:43:30Z")

</div>

@ascheman I think there’s two things going on.

1. For either your project/organization, you probably have **Execute Analysis** permissions set to **Anyone**. This is a very bad idea, because it means that anybody (authenticated to SonarQube or not) could run an analysis against your project. Eventually, we want to get rid of this option altogether.  

2. So why is it working with _v5_ of the Scanner for Gradle but not _v6_? Probably an error on our part. _v6_ of the Scanner for Gradle calls an API (to support JRE auto-provisioning) that requires authentication, even if you have granted the Execute Analysis permissions to **Anyone**.

Now, I still don’t know why, when you set `SONAR_TOKEN`, you don’t see it configured correctly. In my runs, I see the `***` I expect to see.

```auto
2024-12-19T12:36:59.2206554Z ##[debug]..Evaluating String:
2024-12-19T12:36:59.2206679Z ##[debug]..=> 'GITHUB_TOKEN'
2024-12-19T12:36:59.2207163Z ##[debug]=> '***'
2024-12-19T12:36:59.2207380Z ##[debug]Result: '***'
2024-12-19T12:36:59.2208024Z ##[debug]Evaluating: secrets.SONAR_TOKEN
2024-12-19T12:36:59.2208126Z ##[debug]Evaluating Index:
2024-12-19T12:36:59.2208216Z ##[debug]..Evaluating secrets:
2024-12-19T12:36:59.2208328Z ##[debug]..=> Object
2024-12-19T12:36:59.2208433Z ##[debug]..Evaluating String:
2024-12-19T12:36:59.2208527Z ##[debug]..=> 'SONAR_TOKEN'
2024-12-19T12:36:59.2208768Z ##[debug]=> '***'
2024-12-19T12:36:59.2208938Z ##[debug]Result: '***'

```

If I were you, I’d try setting some other variables and seeing if you get the same results (do they show up as `null` or `***`? Is it specific to the Gradle step or does it happen in other steps as well?)

---

_[View the full topic](https://community.sonarsource.com/t/401-during-gh-workflow-of-gradle-sonar-task-with-sonarcloud/132159)._