Feature improvement: SonarCloud -> GitHub integration

SonarQube Cloud
1

Here’s a suggestion for inprovement.

I have created a SonarCloud GitHub action integration and it works fine when I push code to my repository.

But when DependaBot submits a pull-request and the scan starts , then I always get this error:

“The format of the analysis property sonar.token= is invalid”

So, apparently, after many wasted hours, the problem is in the GitHub action script you generate for me in sonarcloud:

name: SonarQube
on:
push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened]

A solution is to change the trigger from pull_request to pull_request_target or improve the guidance and documentation and perhaps also the generated github action template in SonarCloud.

The problem is that the SONAR_TOKEN secret not provided to the script when dependabot creates the PR.

Or perhaps, include some "helpful hints, in the error message, so guiding developers on how to troubleshoo this.

i wish I didn’t have to waste many hours on this problem.

2

Hey @tn-dev

My understanding is that pull_request_target runs in the context of the base of the pull request, rather than in the context of the merge commit.

Aditionally:

Avoid using this event if you need to build or run code from the pull request.

So I don’t think that this is the appropriate event to trigger PR analysis, since the SonarQube Scanner should be analyzing the code in the PR.

All of that said,:

I can understand this happening if dependabot is forking the repo and making their changes in the fork before submitting a PR… but in my experience with Dependabot, a branch is created on the repo itself (no fork). And therefore the workflow has access to repo secrets (like SONAR_TOKEN). Does it work differently in your project?

3

I am only running within my own repository (no Fork).

See

I am not an expert here, but I am not doing anything out of the ordinary, I have a public repo, with dependabot enabled.

Seems after doing some research that pull_request_target, is not the correct way either.

but, then I would like to know, what the recommend way to run sonarcloud when Dependabot creates a PR? As Sonarcloud needs the secret somehow.