How to use SonarCloud with a forked repository on GitHub?

codyebberson · February 10, 2022, 11:40pm

Hello all–

After much struggle, we now have a Github repo that can run SonarCloud analysis on pull requests from forks.

The trick is the “workflow_run” feature from Github Actions:

In short, you need 2 separate Github Actions:

Build step - Build your project, run tests, upload code coverage. This step does not have access to any Github secrets such as SONAR_TOKEN.
Sonar step - Download code coverage from previous step, and run the SonarCloud analysis. This step does have access to SONAR_TOKEN.

The reason this works is because the 2nd step uses Github Actions from main/master, not from the pull request. That way you can be confident that the PR didn’t modify the build scripts, and leak all of your secrets.

Our repo here:

Build action here:

github.com

medplum/medplum/blob/main/.github/workflows/build.yml

name: Build
on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres
        env:
          POSTGRES_DB: medplum_test
          POSTGRES_USER: medplum
          POSTGRES_PASSWORD: medplum
        options: >-
          --health-cmd pg_isready
          --health-interval 10s

This file has been truncated. show original

Sonar action here:

github.com

medplum/medplum/blob/main/.github/workflows/sonar.yml

name: Sonar
on:
  workflow_run:
    workflows: [Build]
    types: [completed]
jobs:
  sonar:
    name: Sonar
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    steps:
      - uses: actions/checkout@v2
        with:
          repository: ${{ github.event.workflow_run.head_repository.full_name }}
          ref: ${{ github.event.workflow_run.head_branch }}
          fetch-depth: 0
      - name: 'Download code coverage'
        uses: actions/github-script@v5
        with:
          script: |

This file has been truncated. show original

Here is some excellent background reading from the Github security team about why all of this is so complicated:

If folks are interested, I can write up a more detailed explanation. Hope this helps someone. Today is the first day we ran Sonar analysis on a PR from a fork, and it felt great.