Hi, We are using sonarcloud for for static code analysis and repositories and pipelines are in Azure DevOps. Currenlty we use pull request decoration and for that at Sonarcloud side we are giving Personal access token ar project level and Project administrator is maintaining it.
Is it a best practice to assign the personal access token at organization level and that can be used across all projects in Organization or at project level?
As we are currently using at project level is it possible to change it to Organization level.
Yes, it is the best practice to put the access token on the organization level. This way you can change the token in one place once it expires.
The token set in the org level will be used in the context of the projects if you projects are bound. That means if they were imported in the recommended way (you should see the Azure DevOps icon near the project name if the project supports re-using the token on the organization level):
If you can see the icon next to the project name, you can clear the token set on the project level, and the org level token will be used. If you cannot see the icon, it means you created projects manually and cannot benefit from the feature.
Thank you for the information.
when I looked at the sonarcloud setup, organization was created manually while we were testing the migraiton from onprem sonarqube server to sonarcloud.
Projects in the sonarqube are creating from the analysis. I can see the option now o connect to Azure DevOps organization in the Sonarcloud organization settings.
We have currently around 190 projects in Sonarcloud. If iIconnect to the Azure DevOps organization what happens to the existing projects? How does this import works? Will there be a project created in the Sonarcloud with the same project name which is in DevOps? As we scan the repositories how does this importing projecs/repositories work?
With our current setup is it possible to convert into importing organization?
We have currently around 190 projects in Sonarcloud. If iIconnect to the Azure DevOps organization what happens to the existing projects?
Nothing will happen to them, they will still exist and everything will work as it was working before.
How does this import works?
Currently, the only way to import a project and do not have to specify the token on the project level is through:
First select “analyze the new project”:
Will there be a project created in the Sonarcloud with the same project name which is in DevOps?
Yes, if you import the project, let’s say with the name “newProjectTest”, the name on the sonarcloud will be “newProjectTest”
With our current setup is it possible to convert into importing organization?
You can bind the organization to Azure, and benefit from importing the projects for the new projects that you would like to add to the organization. There is currently now way to convert manually imported projects into bound projects. We have an objective to migrate all manual projects into bound ones (if the organization is bound to Azure) but I cannot provide you with ETA on this one.
