Product: SonarQube Cloud (US region, sonarqube.us)
Organization: PEC
DevOps platform: GitHub, bound at organization-level
CI: GitHub Actions, self-hosted Windows runner
Hi ! I am working on establishing a DevOps platform for a client and I have been observing this ‘Anonymous User’ tooltip which I would like to understand what’s the suggestion from SonarQube side on resolving this. I was able to find few things after several tests with the help of my team. Let me summarize the observation with problem statement and analysis.
Issue
The “Last commit … By” tooltip on branch and pull request pages shows “Anonymous User” for commits by users who sign in to SonarQube Cloud through our enterprise SSO only. Commits by a user who also has a GitHub-linked SonarQube account show that user’s name correctly.
What we verified
-
My SonarQube account is SSO-only. Its same email address listed under SCM Accounts and in SonarQube, and I’m an org member with Admin.
-
I made a test commit whose author and committer are both exactly my email address <firstname.lastname@. GitHub links it to my GitHub account (my-github-user). The SonarQube tooltip still showed “Anonymous User”.
-
Line blame in the Code tab shows my email correctly, so SCM data is being received.
-
A colleague who has both an SSO account and a GitHub-linked account opened a PR. Its commit tooltip showed his name
-
When I merged my colleagues PR in the GitHub UI, I became the author of the merge commit. The Dev branch tooltip for that commit showed “Anonymous User”.
-
When an SSO user logs in with GitHub, SonarQube offers to move their email from the SSO account to a new GitHub-linked account. That leaves two accounts per person, with notifications and auto-assignment moving to the new one.
Questions
- Does the commit-author tooltip resolve users by GitHub identity rather than by email or SCM accounts?
- Can an existing SSO account be associated with a GitHub identity for commit attribution, without creating a second GitHub-linked account?
- If not, what’s the recommended setup for organizations that use enterprise SSO but want commit attribution? We’d like to avoid duplicate accounts per user, permissions that have to be maintained twice, and accounts that our identity provider doesn’t manage.
Attaching two screenshots, one which my colleague raised a PR for which their names show up (E), and other is my PR that says ‘Anonymous User’.
