Failed to query JRE metadata:failed with HTTP 403

[BansalGaurav (Gaurav Bansal)]

• ALM used :- Bitbucket Cloud
• CI system used :- Bitbucket Cloud
• Below Scanner command used in bitbucket repository

       name: Build, test and analyze on SonarCloud
       image: maven:3.8.4-openjdk-17
       caches:
         - maven
         - sonar
       script:
         - mvn -B verify -s settings.xml org.sonarsource.scanner.maven:sonar-maven-plugin:sonar

• Languages of the repository :- Java / Spring-boot

• Error observed (wrap logs/code around with triple quotes ``` for proper formatting)

[INFO] Communicating with SonarQube Cloud
[INFO] JRE provisioning: os[linux], arch[x86_64]
[ERROR] Failed to query JRE metadata: GET https://api.sonarcloud.io/analysis/jres?os=linux&arch=x86_64 failed with HTTP 403. Please check the property sonar.token or the environment variable SONAR_TOKEN.
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------

• Step to resolve :- Create new sonar token and update it in Bitbucket repository variables.

We maintain around 100+ private repositories in Bitbucket from last 4-5 years but we never faced this issue in past. But from last 1-2 weeks , We have started facing this issue in our bitbucket pipelines. After re-generating the token and updating it in Bitbucket repository variables , this issue gets resolved.
It wastes the time of developer and manual effort is required to debug the issue and create the token and update it repositories.

We would like to understand

• What is the reason of getting this error suddenly in our pipelines?
• Any solution by which these errors can be avoided.

[Colin]

Hey @BansalGaurav

It is likely related to one of these two changes:

Important Security Update: Removal of the “Anyone” Group

Dear community, As part of our commitment to keeping your organization’s data secure, we are removing the Anyone group from SonarQube Cloud. The Anyone group was not aligned to the explicit Members group model and did not effectively communicate who was granted access when in use. The removal of the Anyone group is a proactive security measure – we’d like to assure you that we haven’t identified any exploitation of this group by malicious users. What’s changing: The Anyone group will no long…

Removing inactive tokens after 60 days

Hello SonarQube Cloud Users, To enhance enterprise, organization, and user security, a new policy will be implemented. Effective immediately, User API tokens that have been inactive for 60 days will be automatically removed. SonarQube Cloud’s token capabilities will be further enhanced in the coming months. Please don’t hesitate to share any feedback on this important topic directly via our roadmap.

[BansalGaurav (Gaurav Bansal)]

Hey @Colin ,

Thanks for these links.

Now it looks like out pipelines are failing due to following change Removing inactive tokens after 60 days

But it is inconvenient and would like to have token with longer expiry date.
I understand some more features are in roadmap but is there any other workaround solution ?

[Colin]

One workaround is to use the same token across multiple projects, rather than having a separate token for each one. This way, the token is regularly used and is less likely to be flagged as inactive and removed after 60 days.

However, if you prefer separate tokens for each project, unfortunately there isn’t a way to change the inactivity expiration period right now. You’ll need to wait for future updates where this might become configurable or managed differently.