# Github action should fail on authentication error **URL:** \ **Category:** SonarQube Cloud\ **Tags:** github-actions\ **Created:** [August 31, 2025, 9:26am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720 "2025-08-31T09:26:31Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![damienbod](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/damienbod/32/58504_2.png) [@damienbod](https://community.sonarsource.com/u/damienbod)\ **Post date:** [August 31, 2025, 9:26am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/1 "2025-08-31T09:26:31Z")
When building and running a github action, the secret is missing from my [sonarcloud.io](http://sonarcloud.io). The build fails but the error is displayed as a warning and 5 lines later, the build outputs 0 warnings. I think this should be an error and the build should fail. Logs example: 08:10:55.315 Updating build integration targets… 08:10:55.711 WARNING: Authentication with the server has failed. 08:10:55.711 WARNING: In version 7 of the scanner, the default value for the sonar.host.url changed from “[http://localhost:9000](http://localhost:9000)” to “[https://sonarcloud.io](https://sonarcloud.io/)”. If the intention was to connect to the local SonarQube instance, please add the parameter: /d:sonar.host.url=“[http://localhost:9000](http://localhost:9000)” 08:10:55.712 Pre-processing failed. Exit code: 1 Determining projects to restore… Restored D:\a\EndToEndSecurity\EndToEndSecurity\server\BffMicrosoftEntraID.Server.csproj (in 17.74 sec). BffMicrosoftEntraID.Server → D:\a\EndToEndSecurity\EndToEndSecurity\server\bin\Release\net9.0\BffMicrosoftEntraID.Server.dll Build succeeded. ```auto 0 Warning(s) 0 Error(s) ``` ---
**Author:** ![rufer7](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/rufer7/32/49874_2.png) [@rufer7](https://community.sonarsource.com/u/rufer7)\ **Post date:** [August 31, 2025, 9:35am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/2 "2025-08-31T09:35:23Z")
I faced the same behavior. I would also prefer the auth warning to be an error instead so that the actions workflow fails at this point. Furthermore, I could resolve the issue by recreating the sonarqube cloud token and update the value in GitHub actions secrets. However, I was wondering why my former token was not there anymore in SonarQube Cloud. Any idea? Was this erased while the migration of the plans by Sonar? ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [September 1, 2025, 11:14am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/3 "2025-09-01T11:14:19Z")
Hey @damienbod Can you share your full GitHub actions workflow? @rufer7 Sounds like it might be related to this: > [@Removing inactive tokens after 60 days](https://community.sonarsource.com/t/removing-inactive-tokens-after-60-days/142451): > > Hello SonarQube Cloud Users, To enhance enterprise, organization, and user security, a new policy will be implemented. Effective immediately, User API tokens that have been inactive for 60 days will be automatically removed. SonarQube Cloud’s token capabilities will be further enhanced in the coming months. Please don’t hesitate to share any feedback on this important topic directly via our [roadmap](https://portal.productboard.com/sonarsource/1-sonarqube-cloud/c/390-organization-tokens). ---
**Author:** ![rufer7](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/rufer7/32/49874_2.png) [@rufer7](https://community.sonarsource.com/u/rufer7)\ **Post date:** [September 1, 2025, 11:30am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/4 "2025-09-01T11:30:54Z")
Thank you @Colin for the hint. Seems to match, yes. My token was inactive for more than 60 days. This automatic deactivation is unexpected and imho unintentional (i.e. if you set it up for a project that is in maintenance mode and gets updates every half a year for example). Find my example (incl. GitHub actions workflow) [here](https://github.com/rufer7/github-sonarcloud-integration). For an example of the warning log entry, see [this run](https://github.com/rufer7/github-sonarcloud-integration/actions/runs/17353980590/job/49264278633) ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [September 1, 2025, 11:34am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/5 "2025-09-01T11:34:53Z")
I think that adding `$ErrorActionPreference = "Stop"` would provide the behavior you’re looking for. Can you try it out? ```auto - name: Build and analyze env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} shell: powershell run: | $ErrorActionPreference = "Stop" .\.sonar\scanner\dotnet-sonarscanner begin /k:"rufer7_github-sonarcloud-integration" /o:"rufer7" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.projectBaseDir="D:\a\github-sonarcloud-integration\github-sonarcloud-integration" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml dotnet build .\src\ArbitrarySolution.sln --configuration Release dotnet-coverage collect 'dotnet test .\src\ArbitraryProject.Tests\ArbitraryProject.Tests.csproj' -f xml -o 'coverage.xml' .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}" ``` It might make sense that this goes in the official tutorial… surprised it hasn’t come up before now ---
**Author:** ![rufer7](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/rufer7/32/49874_2.png) [@rufer7](https://community.sonarsource.com/u/rufer7)\ **Post date:** [September 1, 2025, 11:40am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/6 "2025-09-01T11:40:52Z")
Unfortunately same behavior as before. See [Try suggestion from Sonar Community · rufer7/github-sonarcloud-integration@0825860 · GitHub](https://github.com/rufer7/github-sonarcloud-integration/actions/runs/17376472596/job/49323796901) My expected behavior requires `WARNING: Authentication with the server has failed.` to be an error (throw exception!?) instead of just logging a warning. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [September 1, 2025, 11:41am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/8 "2025-09-01T11:41:51Z")
weird. I’m calling in reinforcements! ---
**Author:** ![Martin\_Strecker](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/martin_strecker/32/32318_2.png) [@Martin\_Strecker](https://community.sonarsource.com/u/Martin_Strecker)\ **Post date:** [September 2, 2025, 11:46am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/9 "2025-09-02T11:46:09Z")
Hello @rufer7 in the log, you can see that the [begin command exited with exit code 1](https://github.com/rufer7/github-sonarcloud-integration/actions/runs/17376472596/job/49323796901#step:8:22). ```auto 11:38:13.569 Pre-processing failed. Exit code: 1 ``` `$ErrorActionPreference` as suggested by @Colin is the right idea, but it sets the stop behavior for powershell CmdLets but is ignored for native commands by default. `dotnet-sonarscanner` is a native command and you can make `$ErrorActionPreference` work for it by setting [`$PSNativeCommandUseErrorActionPreference`](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_preference_variables?view=powershell-7.5#psnativecommanduseerroractionpreference) to `$true`. For more details see also: [Stop a script when an error occurs in PowerShell - Meziantou's blog](https://www.meziantou.net/stop-the-script-when-an-error-occurs-in-powershell.htm) You can experiment with this ps1 script locally to see the differences: ```ps1 $ErrorActionPreference = "Stop" $PSNativeCommandUseErrorActionPreference = $true robocopy Nonexistent Write-Host "I'm still running." ``` Prints: ```auto ... ERROR : No Destination Directory Specified. ... NativeCommandExitException: C:\test.ps1:3 Line | 3 | robocopy Nonexistent | ~~~~~~~~~~~~~~~~~~~~ | Program "Robocopy.exe" ended with non-zero exit code: 16. ``` ---
**Author:** ![rufer7](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/rufer7/32/49874_2.png) [@rufer7](https://community.sonarsource.com/u/rufer7)\ **Post date:** [September 2, 2025, 12:29pm UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/10 "2025-09-02T12:29:09Z")
> [@Martin\_Strecker](#): > > ```auto > $ErrorActionPreference = "Stop" > $PSNativeCommandUseErrorActionPreference = $true > > ``` @Martin_Strecker thank you for your investigations and for the reply! Much appreciated. I just tested the recommendations and it seems like it didn’t work as expected (see [here](https://github.com/rufer7/github-sonarcloud-integration/actions/runs/17403387989/job/49401543098)). Build command still gets executed. ---
**Author:** ![rufer7](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/rufer7/32/49874_2.png) [@rufer7](https://community.sonarsource.com/u/rufer7)\ **Post date:** [September 2, 2025, 1:04pm UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/11 "2025-09-02T13:04:22Z")
@Martin_Strecker seems to me like the [main method of the `dotnet-sonarscanner`](https://github.com/SonarSource/sonar-scanner-msbuild/blob/c0cc1c143562759dc172c8a8cc054c1f324cd427/src/SonarScanner.MSBuild/Program.cs#L30) should return `void` or may `Task` instead of `Task` to make it work as expected - otherwise the `Environment.ExitCode` property gets ignore as far as I understand from the docs. See [Environment.ExitCode Property - Remarks](https://learn.microsoft.com/en-us/dotnet/api/system.environment.exitcode?view=net-9.0&WT.mc_id=MVP_344197#remarks) ---
**Author:** ![Martin\_Strecker](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/martin_strecker/32/32318_2.png) [@Martin\_Strecker](https://community.sonarsource.com/u/Martin_Strecker)\ **Post date:** [September 3, 2025, 8:22am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/12 "2025-09-03T08:22:31Z")
Hello @rufer7 It looks like your workflows run on windows-latest with [Powershell Desktop](https://github.com/rufer7/github-sonarcloud-integration/actions/runs/17403387989/workflow#L49). `$PSNativeCommandUseErrorActionPreference` is supported on Powershell Core 7.4. and above only. Please change the shell to `pwsh`. See also here for more details: > **[Workflow syntax for GitHub Actions - GitHub Docs](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsshell)** > > A workflow is a configurable automated process made up of one or more jobs. You must create a YAML file to define your workflow configuration. See also this discussion on GitHub actions which is exactly about your problem: > > > \### Description > > There have been multiple issues asking to change the behavior o…f \`pwsh\` to respect executables exit codes. Since pwsh v7.3, there's a new setting to do exactly what other shells do: \`PSNativeCommandUseErrorActionPreference\`. This has become mainstream in pwsh v7.4: https://learn.microsoft.com/en-us/powershell/scripting/learn/experimental-features?view=powershell-7.4#psnativecommanderroractionpreference > > One of the issues that this has come up before: > \* https://github.com/actions/runner-images/issues/6668 > > Depends on updating pwsh: https://github.com/actions/runner-images/issues/8847 > > \### Platforms affected > > \- \[\] Azure DevOps > \- \[\] GitHub Actions - Standard Runners > \- \[\] GitHub Actions - Larger Runners > > \### Runner images affected > > \- \[\] Ubuntu 20.04 > \- \[\] Ubuntu 22.04 > \- \[\] macOS 11 > \- \[\] macOS 12 > \- \[\] macOS 13 > \- \[\] Windows Server 2019 > \- \[\] Windows Server 2022 > > \### Image version and build link > > https://github.com/getsentry/sentry-unity/actions/runs/6999733486/job/19047630987 > > \### Is it regression? > > no > > \### Expected behavior > > (Native) executable errors should propagate and fail the step, the same way they would on other shells. > > Docs already indicate they should: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference > > \### Actual behavior > > Errors let the step script continue as if nothing has happened, leading to an incorrect CI execution. > > This partially works if there's a single command, because that one will get its exit code propagated > > \### Repro steps > > create a multiline run step, the first shell command failing, the second one passing (zero exit code) Regarding the exit code you are right, in the sense that `Environment.ExitCode` is ignored, but we also return the right exit code from main, so that it is still propagated: ```ps1 > dotnet-sonarscanner begin ... Expecting at least the following command line argument: ... Pre-processing failed. Exit code: 1 > $LASTEXITCODE 1 ``` ---
**Author:** ![rufer7](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/rufer7/32/49874_2.png) [@rufer7](https://community.sonarsource.com/u/rufer7)\ **Post date:** [September 3, 2025, 8:35am UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/13 "2025-09-03T08:35:28Z")
@Martin_Strecker thanks for analyzing and investigation! Much appreciated. I just changed the shell to `pwsh`, added `$ErrorActionPreference = "Stop"` and `$PSNativeCommandUseErrorActionPreference = $true` and now it seems to work as expected. ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/8/a/8ac8d7b225ca1bfe36600a15bbaff09f1327e3ec.png) To be honest, it’s not really intuitive that `ErrorActionPreference` and `PSNativeCommandUseErrorActionPreference` have to be set. Thanks a lot for your support. ---
**Author:** ![Martin\_Strecker](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/martin_strecker/32/32318_2.png) [@Martin\_Strecker](https://community.sonarsource.com/u/Martin_Strecker)\ **Post date:** [September 3, 2025, 12:41pm UTC](https://community.sonarsource.com/t/github-action-should-fail-on-authentication-error/147720/17 "2025-09-03T12:41:48Z")
@rufer7 I’m glad to hear it worked and thank you for your patience. > To be honest, it’s not really intuitive that `ErrorActionPreference` and `PSNativeCommandUseErrorActionPreference` have to be set. We agree, but there is nothing we can do to improve the situation, except updating our documentation by adopting your setup (Powershell Core and “fail-fast”). I created a ticket for our documentation team to do this. Maybe [Github Actions change the default for scripts](https://github.com/actions/runner-images/issues/8900#issuecomment-2336786139) in the future, but this would be a breaking change and will likely not happen.