Configuring a secured GitHub workflow to launch a Sonar analysis for PR from forks

SonarQube Cloud
, , , ,
14

A few changes have been made on these workflows since my last answer:

  • in the workflow “CI on forks - build and tests”, the step “Save PR Information” should become:
      - name: Save PR Information
        if: matrix.os == 'ubuntu-latest'
        env:
          REPO_NAME: ${{ github.event.pull_request.head.repo.full_name }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: |
          mkdir -p pr-info
          echo "$REPO_NAME" > pr-info/repo-name
          echo "$HEAD_REF" > pr-info/head-ref
          echo "$HEAD_SHA" > pr-info/head-sha
          echo "$PR_NUMBER" > pr-info/pr-number
          echo "$BASE_REF" > pr-info/base-ref

It will avoid having security issues.

  • due to this issue, I updated the action and removed the quotes around the arguments values in the third workflow (“CI on forks - Sonar analysis”), in the step “Run Sonar Analysis”

You can see the changes for example in this PR.