Dear Sonar Team!
The official documentation mentions GITHUB_TOKEN needs to be explicitly configured, for “PR information”.
However when you are creating a new project, the suggested default Gradle pipeline misses this property. See code that the SonarCloud presents you as part of onboarding a new project:
name: SonarQube
on:
push:
branches:
- master
pull_request:
types: [opened, synchronize, reopened]
jobs:
build:
name: Build and analyze
runs-on: ubuntu-latest
steps:- uses: actions/checkout@v4
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: 17
distribution: ‘zulu’ # Alternative distribution options are available- name: Cache SonarQube packages
uses: actions/cache@v4
with:
path: ~/.sonar/cache
key: ${{ runner.os }}-sonar
restore-keys: ${{ runner.os }}-sonar- name: Cache Gradle packages
uses: actions/cache@v4
with:
path: ~/.gradle/caches
key: ${{ runner.os }}-gradle-${{ hashFiles(‘**/*.gradle’) }}
restore-keys: ${{ runner.os }}-gradle- name: Build and analyze
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
run: ./gradlew build sonar --info
Is it important to set the GITHUB_TOKEN for a successful pull-request build in GitHub Actions or not?
Thanks and cheers,
Balazs
