How to use SonarCloud with a forked repository on GitHub?

CSchulz · March 4, 2019, 8:11pm

I know about that feature plans, but it doesn’t improve the situation at the moment.

With removing the preview analysis option, it is not possible to have at least one check before getting stuff merged into your own repository.
Before it was possible to run the scanner in preview / issues mode to get an analysis of the changed sources.

What is the official statement of SonarSource to keep running the environment like that?

derTobsch · February 6, 2020, 12:36pm

Are there any news? The Issue https://jira.sonarsource.com/browse/MMF-1371 is not so active

warden · April 2, 2020, 10:58am

Bump, any news on that?
Our setup in Jenkins is that we have people all over the world using forks to contribute to https://github.com/jenkinsci/ repositories, we’d love to use SonarCloud integration to get feedback on the PRs from external forks.

eastfisher · May 18, 2020, 3:43pm

What will happen if I hard code the sonar token into the workflow yml file?

janos · May 19, 2020, 5:51am

We cannot recommend adding secrets to version control.

Not yet!

Not yet! I recommend to check again after 4-6 months.

wlad · October 14, 2020, 5:38pm

Not yet! I recommend to check again after 4-6 months.

how is it going

janos · October 15, 2020, 12:55pm

We still don’t have an ETA, and it won’t happen before the end of the year.

We do recognize this is a highly wanted feature, and I hope we’ll be able to squeeze it in our roadmap for next year.

Feel free to ping us again after 3+ months.

Enrique_Vetere · February 15, 2021, 2:41pm

bump. Any updates on this?

janos · March 4, 2021, 1:48pm

As far as I know this topic did not become an explicit target on our roadmap for the year. That doesn’t mean it won’t happen, it just didn’t make it into the top. This is very important to us, and we’ll try to squeeze it in our monthly plannings.

Feel free to ping us again after 4-6 months.

slawekjaranowski · March 7, 2021, 11:26am

What do you think - what difference will be:

anonymous (without token) analyses supported by sonar
token in code for technical account which has only analyses permission

planetf1 · August 18, 2021, 8:33am

Any news on this. I also work on an OSS project where we all use forks. We don’t feel comfortable adding secrets into the repo, which means we can’t use sonarcloud for PR decoration.

Whilst the sonar results are great, they are rarely looked at. To be effective we MUST have scans/changes being shown within the development cycle, or at PR/review time.

We are now using codeQL and Lift instead as Sonar cant do this (even though we like the reports and scans the best overall, if they’re ignored, there’s no point)

I hope we can see this issue being addressed soon. This is such a normal way of working in open source

Peeter_Piegaze · August 25, 2021, 3:43pm

Hi Nigel,

Unfortunately we do not have any update on this topic at this time.
We do agree that this is an important issue for us to tackle.
I will nudge product management.

JFCote · October 15, 2021, 3:27pm

Any news on this?

Having failed sonarcloud analysis on each PR is pretty bad since we can’t share secrets to forks. I love Sonarcloud and would love to use it for our OSS but right now, I’m checking for alternative that truly support OSS.

Peeter_Piegaze · October 20, 2021, 11:52am

Unfortunately, I have no update from product management at this time.

Martin_Bednorz · October 29, 2021, 3:23pm

Hello everyone!

You can now subscribe to future updates and provide feedback on this feature on our roadmap page: SonarCloud analyzes external Pull Request - SonarCloud | Product Roadmap .

We still do not have an ETA, but this is a frequently requested feature for SonarCloud and we want to remove the friction as soon as possible.

codyebberson · February 10, 2022, 11:40pm

Hello all–

After much struggle, we now have a Github repo that can run SonarCloud analysis on pull requests from forks.

The trick is the “workflow_run” feature from Github Actions:

In short, you need 2 separate Github Actions:

Build step - Build your project, run tests, upload code coverage. This step does not have access to any Github secrets such as SONAR_TOKEN.
Sonar step - Download code coverage from previous step, and run the SonarCloud analysis. This step does have access to SONAR_TOKEN.

The reason this works is because the 2nd step uses Github Actions from main/master, not from the pull request. That way you can be confident that the PR didn’t modify the build scripts, and leak all of your secrets.

Our repo here:

Build action here:

github.com

medplum/medplum/blob/main/.github/workflows/build.yml

name: Build
on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres
        env:
          POSTGRES_DB: medplum_test
          POSTGRES_USER: medplum
          POSTGRES_PASSWORD: medplum
        options: >-
          --health-cmd pg_isready
          --health-interval 10s

This file has been truncated. show original

Sonar action here:

github.com

medplum/medplum/blob/main/.github/workflows/sonar.yml

name: Sonar
on:
  workflow_run:
    workflows: [Build]
    types: [completed]
jobs:
  sonar:
    name: Sonar
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    steps:
      - uses: actions/checkout@v2
        with:
          repository: ${{ github.event.workflow_run.head_repository.full_name }}
          ref: ${{ github.event.workflow_run.head_branch }}
          fetch-depth: 0
      - name: 'Download code coverage'
        uses: actions/github-script@v5
        with:
          script: |

This file has been truncated. show original

Here is some excellent background reading from the Github security team about why all of this is so complicated:

If folks are interested, I can write up a more detailed explanation. Hope this helps someone. Today is the first day we ran Sonar analysis on a PR from a fork, and it felt great.

dhavaltdesai · February 23, 2022, 8:15am

Thank you for sharing this. We will surely try this out. If this works then we can stay with Sonar for longer.

nixel2007 · May 12, 2022, 3:12am

Okay, I’ve finally managed it. @codyebberson’s version didn’t work for me, cause workflow_run event data doesn’t have pull request info and pull_requests array contains pull requests to fork and not to upstream.

So, this is my version with comments.

First of all you need to save PR number from pull_request event. You can achieve this by echoing data from event to file and upload it as artifact:

github.com

1c-syntax/bsl-language-server/blob/21a6bb5172cbc4591a05414d5d0ac221689e45ce/.github/workflows/gradle.yml#L38

      
        
                java-version: ${{ matrix.java_version }}
                distribution: 'temurin'
            - name: Build with Gradle
              run: ./gradlew check --stacktrace
            - name: Archive test results
              if: failure()
              uses: actions/upload-artifact@v3
              with:
                name: junit_report_${{ matrix.os }}_${{ matrix.java_version }}
                path: build/reports/tests/test
            - name: Save PR number to file
              if: github.event_name == 'pull_request' && ${{ matrix.os }} == 'ubuntu-latest' && ${{ matrix.java_version }} == '17'
              run: echo ${{ github.event.number }} > PR_NUMBER.txt
            - name: Archive PR number
              if: github.event_name == 'pull_request' && ${{ matrix.os }} == 'ubuntu-latest' && ${{ matrix.java_version }} == '17'
              uses: actions/upload-artifact@v3
              with:
                name: PR_NUMBER
                path: PR_NUMBER.txt

And then…

In a separate workflow with workflow_run trigger you need to:

download artifact from workflow that triggered the current workflow
read it to workflow data
get PR data via github rest api
checkout repo (from fork)
fetch base branch from upstream - this is important step! If you won’t do it, your “new lines of code” metric will be broken if fork has not synchronized base branch (and who do it nowdays?)
and at last - run analysis on push or on pull request grabbing all collected data

github.com

1c-syntax/bsl-language-server/blob/21a6bb5172cbc4591a05414d5d0ac221689e45ce/.github/workflows/qa.yml#L16

      
        
                types: [completed]
            
            
jobs:
            
            
  QA:
                runs-on: ubuntu-latest
                if: github.event.workflow_run.conclusion == 'success'
                steps:
                - name: echo event
                  run: cat $GITHUB_EVENT_PATH
                - name: Download PR number artifact
                  if: github.event.workflow_run.event == 'pull_request'
                  uses: dawidd6/action-download-artifact@v2
                  with:
                    workflow: Java CI
                    run_id: ${{ github.event.workflow_run.id }}
                    name: PR_NUMBER
                - name: Read PR_NUMBER.txt
                  if: github.event.workflow_run.event == 'pull_request'
                  id: pr_number
                  uses: juliangruber/read-file-action@v1

“Java CI” workflow logs: recreate: Исправил FP · 1c-syntax/bsl-language-server@3a6192c · GitHub
“QA” workflow logs: QA · 1c-syntax/bsl-language-server@2211575 · GitHub

There is some room for improvement (fetch only selected branch from upstream, protect from pr from branch with the same name as base branch), but I hope this will help someone.

RCheesley · May 20, 2022, 4:25pm

Thanks so much for sharing this @nixel2007 as I was stuck implementing the suggestions above!

I am almost there, but I am a bit stuck with one part which maybe you can help me with.

I’ve created the sonar.yml in the default branch:

github.com

RCheesley/mautic/blob/4.x/.github/workflows/sonar.yml

name: Sonarcloud scan

on: 
  workflow_run:
    workflows: [Mautic tests and validations]
    types: [completed]

jobs:

  QA:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    steps:
    - name: echo event
      run: cat $GITHUB_EVENT_PATH
    - name: Download PR number artifact
      if: github.event.workflow_run.event == 'pull_request'
      uses: dawidd6/action-download-artifact@v2
      with:
        workflow: Mautic tests and validations

This file has been truncated. show original

I made some tweaks as we needed to specify some args and use a properties file for that, but otherwise it’s the same as yours without the platform-specific stuff, I think (as best I can tell, I’m no expert with GitHub Actions and not a developer!)

Then I have a PR I’m using to test which introduces the properties file and adds the parts to the tests.yml file we already have:

github.com/RCheesley/mautic

Mautic sonar

RCheesley:4.x ← RCheesley:mauticSonar

opened 01:23PM - 13 May 22 UTC

RCheesley

+33 -0

| Q | A | -------------------------------------- | --- | Bug fix? (use the a.b branch) | [ ] | New feature/enhancement? (use the a.x branch) | [ ] | Deprecations? | [ ] | BC breaks? (use the c.x branch) | [ ] | Automated tests included? | [ ] | Related user documentation PR URL | mautic/mautic-documentation#... | Related developer documentation PR URL | mautic/developer-documentation#... | Issue(s) addressed | Fixes #...  #### Description:  #### Steps to test this PR:  1. Open this PR on Gitpod or pull down for testing locally (see docs on testing PRs [here](https://contribute.mautic.org/contributing-to-mautic/tester)) 2.

This is working great, it’s saving the PR number to the text file, and sonar.yml is picking this up.

The bit where I am struggling is that when it runs the scan on PR for example, it’s throwing up this error:

Warning: Unexpected input(s) ‘number’, ‘full_name’, valid inputs are [‘route’, ‘mediaType’]

It seems like it’s actually getting the information but maybe not in the right order? I’m not sure:

Run octokit/request-action@v2.x
with:
route: GET /repos/{full_name}/pulls/{number}
number: 13

full_name: RCheesley/mautic
mediaType: {}
env:
GITHUB_TOKEN: ***

GET /repos/{full_name}/pulls/{number}
> number: 13
> full_name: RCheesley/mautic
> mediaType: [object Object]
(node:1740) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
< 200 346ms

On the PR the GitHub Actions I have reporting are showing like this:

I think it’s running against the whole repo rather than the PR, I’m not entirely sure to be honest.

Any nudges you might be able to offer would be much appreciated!

(I haven’t yet added in the code coverage part as I didn’t want to complicate matters!)

RCheesley · July 18, 2022, 10:04am

May not be entirely the ‘right’ way but I managed to get it mostly working as follows:

I had to make the coverage report from Codecov readable by Sonar and then upload it as an archive so that we can access it in the next step.

github.com

RCheesley/mautic/blob/mauticSonar/.github/workflows/tests.yml#L95


      
              mysql_port: ${{ job.services.mysql.ports[3306] }}
              mariadb_port: ${{ job.services.mariadb.ports[3306] }}
          
          
- name: Upload coverage report
            if: ${{ matrix.php-versions == '7.4' && matrix.db-types == 'mysql' && (github.repository == 'mautic/mautic' || github.repository == 'rcheesley/mautic') }}
            uses: codecov/codecov-action@v2
            with:
              files: ./coverage.xml
              fail_ci_if_error: true
                
          - name: Make Coverage report Sonar readable
            if: ${{ matrix.php-versions == '7.4' && matrix.db-types == 'mysql' }}
            run: |
              report_root="/home/runner/work/rcheesley/mautic"
              scanner_root="/github/workspace"
              sed "s|${report_root}|${scanner_root}|g" coverage.xml > clover.xml
              
          - name: Archive code coverage results
            if: ${{ matrix.php-versions == '7.4' && matrix.db-types == 'mysql' }}
            uses: actions/upload-artifact@v3
            with:

Did the same with the PR number as suggested by @nixel2007 above:

github.com

RCheesley/mautic/blob/mauticSonar/.github/workflows/tests.yml#L211


      
                # test if media/css and media/js folder contain the same files as the tarball releases
                test -z "$(comm -23 <(ls ../media/js  | sort) <(ls docroot/media/js  | sort))"
                test -z "$(comm -23 <(ls ../media/css | sort) <(ls docroot/media/css | sort))"
          
          
      php ./bin/console cache:clear
              else
                echo "Invalid command"
                exit 1
              fi
          
          
- name: Save PR number to file
            if: github.event_name == 'pull_request' && ${{ matrix.php-versions }} == '7.4' && ${{ matrix.db-types }} == 'mysql'
            run: echo ${{ github.event.number }} > PR_NUMBER.txt
          
          
- name: Archive PR number
            if: github.event_name == 'pull_request' && ${{ matrix.php-versions }} == '7.4' && ${{ matrix.db-types }} == 'mysql'
            uses: actions/upload-artifact@v3
            with:
              name: PR_NUMBER
              path: PR_NUMBER.txt

Then grab the PR number per the example above:

github.com

RCheesley/mautic/blob/4.x/.github/workflows/sonar.yml#L16


      
              types: [completed]
          
          
jobs:
          
          
  QA:
              runs-on: ubuntu-latest
              if: github.event.workflow_run.conclusion == 'success'
              steps:
              - name: echo event
                run: cat $GITHUB_EVENT_PATH
              - name: Download PR number artifact
                if: github.event.workflow_run.event == 'pull_request'
                uses: dawidd6/action-download-artifact@v2
                with:
                  workflow: Mautic tests and validations
                  run_id: ${{ github.event.workflow_run.id }}
                  name: PR_NUMBER
              - name: Read PR_NUMBER.txt
                if: github.event.workflow_run.event == 'pull_request'
                id: pr_number
                uses: juliangruber/read-file-action@v1

Download the code coverage artifact and extract it:

github.com

RCheesley/mautic/blob/4.x/.github/workflows/sonar.yml#L50


      
                ref: ${{ github.event.workflow_run.head_branch }}
                fetch-depth: 0
          - name: Checkout base branch
            if: github.event.workflow_run.event == 'pull_request'
            run: |
              git remote add upstream ${{ github.event.repository.clone_url }}
              git fetch upstream
              git checkout -B ${{ fromJson(steps.get_pr_data.outputs.data).base.ref }} upstream/${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}
              git checkout ${{ github.event.workflow_run.head_branch }}
              git clean -ffdx && git reset --hard HEAD
          - name: 'Download code coverage'
            uses: actions/github-script@v5
            with:
                script: |
                  let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
                     owner: context.repo.owner,
                     repo: context.repo.repo,
                     run_id: context.payload.workflow_run.id,
                  });
                  let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
                    return artifact.name == "code-coverage-report"

Make sure that the file can be accessed within the container (hat tip to @sylfabre in this post)

github.com

RCheesley/mautic/blob/4.x/.github/workflows/sonar.yml#L74


      
                     repo: context.repo.repo,
                     artifact_id: matchArtifact.id,
                     archive_format: 'zip',
                  });
                  let fs = require('fs');
                  fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/artifact.zip`, Buffer.from(download.data));
                  
          - name: 'Unzip code coverage'
            run: unzip artifact.zip
            
          - name: SonarCloud Scan on PR
            if: github.event.workflow_run.event == 'pull_request'
            uses: sonarsource/sonarcloud-github-action@master
            with:
              projectBaseDir: '.'
              args: >
                -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }} -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }} -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }} -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }} -Dproject.settings=sonar-project.properties
            env:
              SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
              GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          - name: SonarCloud Scan on push

Scan on PR:

github.com

RCheesley/mautic/blob/4.x/.github/workflows/sonar.yml#L74


      
                     repo: context.repo.repo,
                     artifact_id: matchArtifact.id,
                     archive_format: 'zip',
                  });
                  let fs = require('fs');
                  fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/artifact.zip`, Buffer.from(download.data));
                  
          - name: 'Unzip code coverage'
            run: unzip artifact.zip
            
          - name: SonarCloud Scan on PR
            if: github.event.workflow_run.event == 'pull_request'
            uses: sonarsource/sonarcloud-github-action@master
            with:
              projectBaseDir: '.'
              args: >
                -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }} -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }} -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }} -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }} -Dproject.settings=sonar-project.properties
            env:
              SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
              GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          - name: SonarCloud Scan on push

We use a project properties file so I included that in the args, the file is here:

github.com

RCheesley/mautic/blob/mauticSonar/sonar-project.properties

sonar.projectKey=RCheesley_mautic
sonar.organization=rcheesley
sonar.projectName=mautic
sonar.projectVersion=1.0
sonar.modules=phpmodule
sonar.sourceEncoding=UTF-8
phpmodule.sonar.sources=app,plugins
phpmodule.sonar.projectBaseDir=.
phpmodule.sonar.inclusions=app/*.php,app/**/*.php,plugins/*.php,plugins/**/*.php
phpmodule.sonar.exclusions=app/migrations/**/*,app/bundles/*Bundle/Config/**/*,app/bundles/*Bundle/DataFixtures/**/*,app/bundles/*Bundle/Tests/**/*,app/bundles/*Bundle/Translations/**/*,app/bundles/*Bundle/Views/**/*,app/middlewares/Test/**/*,app/bundles/CoreBundle/Test/**/*,plugins/*Bundle/Config/**/*,plugins/*Bundle/Tests/**/*,plugins/*Bundle/Translations/**/*,plugins/*Bundle/Views/**/*
phpmodule.sonar.cpd.exclusions=**/*
phpmodule.sonar.tests=tests
sonar.php.coverage.reportPaths=clover.xml
sonar.scm.disabled=true

Obvs as this is running on my own fork I had to make quite some tweaks to some of the files as we restrict our actions to running only on our main repo and our private security repo, and had to hard-code a couple of path changes to work on my own fork while I figured it out.

Thanks to everyone for the help so far!