which versions are you using (SonarQube Server / Community Build, Scanner, Plugin, and any relevant extension)
how is SonarQube deployed: zip, Docker, Helm
what are you trying to achieve
what have you tried so far to achieve this
Do not share screenshots of logs – share the text itself (bonus points for being well-formatted)!
This is the third time I’ve started this question over again because it times out forcing me to start over and over again. I will NOT DO IT AGAIN. Therefore, getting all the details this template requires is taking too much time, leaving me no time to write the question!!
We’re using SonarQube server in our Windows domain and we’re using repos in our GitHub Organization.
I’ve searched for the XML file involved, but all results did not help. Here is a snippet from the log detailing the error we’re getting. It happens in step Build and Analyze.
11:56:55.963 Using SonarQube v2026.3.1.123439.
11:56:56.734 Fetching analysis configuration settings…
11:56:56.751 WARNING: To analyze private projects make sure the scanner user has ‘Browse’ permission.
Unhandled exception. System.Net.Http.HttpRequestException: Response status code does not indicate success: 403.
at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
at SonarScanner.MSBuild.PreProcessor.WebClientDownloader.TryDownloadIfExists(Uri url, Boolean logPermissionDenied)
at SonarScanner.MSBuild.PreProcessor.WebServer.SonarWebServerBase.DownloadComponentProperties(String component)
at SonarScanner.MSBuild.PreProcessor.WebServer.SonarQubeWebServer.DownloadComponentProperties(String component)
at SonarScanner.MSBuild.PreProcessor.WebServer.SonarWebServerBase.DownloadProperties(String projectKey, String projectBranch)
at SonarScanner.MSBuild.PreProcessor.PreProcessor.FetchArgumentsAndRuleSets(ISonarWebServer server, ProcessedArgs args, BuildSettings settings)
at SonarScanner.MSBuild.PreProcessor.PreProcessor.DoExecute(BuildSettings buildSettings, ProcessedArgs localSettings)
at SonarScanner.MSBuild.PreProcessor.PreProcessor.Execute(IEnumerable`1 args)
at SonarScanner.MSBuild.BootstrapperClass.PreProcess()
at SonarScanner.MSBuild.BootstrapperClass.Execute()
at SonarScanner.MSBuild.Program.Execute(String args, IRuntime runtime)
at SonarScanner.MSBuild.Program.Main(String args)
at SonarScanner.MSBuild.Program.(String args)
Determining projects to restore…
Back in July I initially set up the SonarQube GitHub App for all repositories, both those at that time and any future repos. I have another application I wrote, which works fine with SonarQube. So, I do NOT understand why it does not work for this repo.
Hey @RodAtDOH, this error typically doesn’t have anything to do with the GitHub app. The Scanner is sending a request to the server but getting a 403, meaning that the SonarQube token used for this analysis does not have enough rights on this specific project, even if it works elsewhere. Could you please:
In SonarQube, open the failing project > Project Settings / Administration > Permissions and ensure the user that owns the token has at least Browse and Execute Analysis on this project.
From that user, create a new global analysis token and use it for analysis in your pipeline.
Hi Andres, thank you for your response! You answer is enlightening to me. So, there is a permissions issue involved, but it involves the SONAR_TOKEN at the GitHub organization level not having enough rights to the specific project on the SonarQube server. I wasn’t aware of that, but it makes sense, now that I know that’s what’s going on. Currently, the team has created a local SONAR_TOKEN secret at the repo level, overriding the secret at the GitHub organization level. I’ve gotten into SonarQube, but I can no longer see the values that were there back when it was trying to use SONAR_TOKEN at the organization level.
I then took a look at another repo; one I created which is just a Blazor Web App created from the Visual Studio template. I haven’t added any code to it, so basically, it is just a “Hello World” app. But it worked fine with SonarQube, and the SONAR_TOKEN begin defined at the GitHub organization level.
I’m thinking that what I’ll have to do is convince the dev team to remove the local SONAR_TOKEN in the repo so that it can use the SONAR_TOKEN at the GitHub organization level, as an experiment. However, they may be reluctant to do that. This is unfortunate. I really wish that this information had been evident when we were first configuring the app that used SONAR_TOKEN at the organization level.
Hey @RodAtDOH, actually, our in-product project onboarding wizard (the one that takes you through the steps to set up analysis for a project) tells you to create a secret at the repo level:
To me, it makes sense to do it this way. This way, the tokens are scoped to the particular project, which is typically a good security practice. But perhaps you prefer having a global one for all projects at the organization level, it’s up to you.
Regarding this particular project that is failing, most likely the token they’re using is expired or the user that was used to generate it no longer has permission to analyze this project. You might want to generate a new token and use it for that repository’s analysis.
The token at the GitHub organization level has not expired.
I believe the problem is what you said yesterday, that the SONAR_TOKEN at the organization level for this project does not have both Browse and Execute Analysis for this project. I got into the SonarQube server portal to verify that but couldn’t. I don’t think I have the correct permissions to see this in the portal. And in any case, since one of the developers created the SONAR_TOKEN in the repo, the conditions are now different. I’ve asked to have the local SONAR_TOKEN removed to see if I’m correct and to see whether SONAR_TOKEN has the necessary permissions, but, well, that hasn’t happened.
Yes, I prefer SONAR_TOKEN to be defined at a level to make it accessible to all repos within an organization. However, I suspect that my professional advice and the recommendations for shallower branching strategies will be ignored. So, never mind. I’ll select one of your answers above and mark it the solution.
