# Issue with Importing GitHub Projects in 10.3 **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** project\_import, saml, github, sonarqube\ **Created:** [December 14, 2023, 7:29pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081 "2023-12-14T19:29:21Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [December 14, 2023, 7:29pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/1 "2023-12-14T19:29:21Z")
We recently upgraded to SonarQube Enterprise 10.3 (build 82913), and use the Helm chart in a k8s cluster. We use Okta/SAML/SCIM to manage users/authentication. We have identified a regression in 10.3 with importing new projects from GitHub. After the project is created, only the creator has read-only access to the project, however not even Admin users can access or modify the project. This is an example of an attempt to perform an API request with an Admin user against the projects created by a different project: ```auto curl -u "$TOKEN:" https://REDACTED/api/projects/update_visibility -X POST -d 'project=my-project_AYw-T2dt8eIyTuaDw4FT&visibility=public' {"errors":[{"msg":"Insufficient privileges"}]} ``` Attempting to import the project again reveals that the project has already been imported, but is not visible to any user other than the original creator. However, creating a new “local” and then manually configuring the “DevOps” settings for the project does not have this issue; this suggests the problem is not with the permissions templates (and indeed I have confirmed the templates have the correct permissions.) Here are the step to reproduce the behavior: 1. Click “Create Project” and from the drop-down select “From GitHub.” 2. Select your organization. 3. Select a repo and click “Import.” 4. Choose “Use the global setting” and click “Create project.” 5. Have another user attempt to access or even find the project in the available projects. Similarly, you will also find that even an Admin user cannot modify the configuration/settings for newly created project. ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [December 14, 2023, 7:56pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/2 "2023-12-14T19:56:38Z")
I just attempted to reproduce this on our test instance, and it didn’t have the issue. I am not sure why one instance we can import projects, and the other we cannot. ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [December 19, 2023, 12:57am UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/3 "2023-12-19T00:57:59Z")
We still have this issue in our production environment. Does anyone have any ideas on how we can debug this issue? ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [December 20, 2023, 8:12am UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/4 "2023-12-20T08:12:30Z")
Hey there. Sorry this got lost! Do you have **Automatic user, group, and permission** provisioning enabled, including **Provision project visibility**? This can be found in your global **Administration \> Authentication \> GitHub** ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/f/6/f609f12e6cc5669b7badaaa64bc2bf002658f07e.png) ---
**Author:** ![smanning](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@smanning](https://community.sonarsource.com/u/smanning)\ **Post date:** [January 5, 2024, 8:19pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/5 "2024-01-05T20:19:54Z")
We are having a similar issue to what Ryan describes, which started occurring after our upgrade to SonarQube Enterprise 10.3. This is happening on both our test and production SonarQube instances. We _do not_ have automatic user, group, and permission provisioning enabled with GitHub. We use SAML (via Pingfederate) to manage user authentication. We _do_ have a DevOps platform integration configured with our self-hosted GitHub instances. Our `Default visibility of new projects` is set to `Public`. This is the testing I’ve completed on our test instance and the results I’m seeing: - Created a new public GitHub repository named `sonarqube-test`. A SonarQube scan is run via a GitHub Actions workflow step. For this example, the SonarScanner for Gradle plugin is being used - A SonarQube project for `sonarqube-test` didn’t exist yet, so a new one was created - Our `Default permissions template for projects` is applied, granting the expected access - **Problem:** the Project visibility is set to `PRIVATE`, not the default `PUBLIC` I enabled TRACE logging for this testing to get as much info as possible and have included what appear to be the relevant logs for this project creation. I redacted some info, replacing it with: `{redacted description}`. **Web.log:** > 2024.01.05 15:46:00 INFO web[{redacted id}][o.s.s.a.w.GithubProjectCreatorFactory] DevOps configuration SonarQube auto-detected for project {redacted owner}/sonarqube-test > 2024.01.05 15:46:00 TRACE web[{redacted id}][sql] time=10ms | sql=INSERT INTO components ( kee, uuid, uuid\_path, branch\_uuid, name, long\_name, qualifier, scope, language, description, private, path, copy\_component\_uuid, enabled, created\_at, b\_changed, deprecated\_kee, b\_copy\_component\_uuid, b\_description, b\_enabled, b\_language, b\_long\_name, b\_name, b\_path, b\_qualifier ) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, null, null, null, 0, null, null, null, null, null ) | params=com.{redacted namespace}:sonarqube-test, {uuid}, {uuid\_path}, {branch\_uuid}, sonarqube-test, sonarqube-test, TRK, PRJ, 12, 12, **true** , 12, 12, true, 2024-01-05 15:46:00.356 > 2024.01.05 15:46:00 TRACE web[{redacted id}][sql] time=5ms | sql=INSERT INTO projects ( kee, qualifier, uuid, name, description, private, tags, creation\_method, created\_at, updated\_at ) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, ? ) | params=com.{redacted namespace}:sonarqube-test, TRK, {uuid}, sonarqube-test, 12, **true** , 12, SCANNER\_API\_DEVOPS\_AUTO\_CONFIG, 1704469560356, 1704469560356 **Access.log:** > {redacted IP} - - [05/Jan/2024:15:46:01 +0000] “POST /api/ce/submit?projectKey=com.{redacted namespace}%3Asonarqube-test&projectName=sonarqube-test&characteristic=devOpsPlatformUrl%3Dhttps%3A%2F%2F{redacted github url}%2Fapi%2Fv3&characteristic=devOpsPlatformProjectIdentifier%3D{redacted owner}%2Fsonarqube-test&characteristic=branch%3Dmaster&characteristic=branchType%3DBRANCH HTTP/1.1” 200 44 “-” “ScannerGradle/4.0.0.2929/Gradle 8.0.2” “{redacted id}” One thing I noticed is that this log message is new: `DevOps configuration SonarQube auto-detected` (our GitHub app is named “SonarQube”). I don’t see it present for project creation logs pre-10.3. I’m assuming that this new log message is related to [this change](https://sonarsource.atlassian.net/browse/SONAR-20699) included in the full release notes for 10.3. However I haven’t been able to figure out why/how this is causing SonarQube to create new projects as `PRIVATE` instead of `PUBLIC`. Any guidance you can provide on this is appreciated, and please let me know if you need additional information from me. This issue is causing permissions problems with our applications that interact with SonarQube because their access is based on the projects being public. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [January 18, 2024, 9:22am UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/7 "2024-01-18T09:22:38Z")
Hey all. I’ve referred this topic to some experts. Thanks for the detailed post @smanning! ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [January 18, 2024, 6:55pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/8 "2024-01-18T18:55:01Z")
> [@Colin](#): > > Do you have **Automatic user, group, and permission** provisioning enabled, including **Provision project visibility**? We do have this enabled, but since we are using SAML we don’t appear to have the “Provision project visibility” option. ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/7/c/7c3c2ada8e9b580458fa5c1fcbb3c799ad82c91e.png) ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [January 18, 2024, 8:40pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/9 "2024-01-18T20:40:10Z")
One other thing which might be worth noting is that while I don’t have the issue on our testing environment, I had setup GitHub authentication on my test instance of SonarQube prior to upgrading to try it out and see if we could pull in GitHub Teams for populating groups. I can’t help but wonder if having both auth schemes somehow allowed things to function properly on that instance. ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [January 22, 2024, 11:16pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/10 "2024-01-22T23:16:23Z")
@smanning Just checking in and see if you folks have any updates or need any additional information to reproduce the issue. Thanks! ---
**Author:** ![wojtek.wajerowicz](https://avatars.discourse-cdn.com/v4/letter/w/85f322/32.png) [@wojtek.wajerowicz](https://community.sonarsource.com/u/wojtek.wajerowicz)\ **Post date:** [January 23, 2024, 12:46pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/12 "2024-01-23T12:46:40Z")
Hi @RyanH and @smanning, Thank you for providing the details. I’ve looked into the issue and it is indeed a bug in SonarQube 10.3. It is indeed related to [auto-binding projects to GitHub DevOps Platform configuration](https://sonarsource.atlassian.net/browse/SONAR-20699). If the project is created by running scanner in GitHub Actions and automatically bound to DevOps Platform config project permissions and visibility are not correctly set: - if the instance is managed by SCIM, the visibility is always set to false and the permission templates are not applied( @RyanH’s case) - if the instance is not managed(neither by SCIM nor by syncing users from GitHub), the visibility is set to false and the permission templates are correctly applied(@smanning’s case). We will fix the issue for the upcoming 10.4 release. ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [January 23, 2024, 5:27pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/13 "2024-01-23T17:27:57Z")
@wojtek.wajerowicz Awesome, thank you! Will the 10.4 upgrade fix the projects which are in bad states as part of the DB schema upgrade, or will we need run a SQL script to fix these? ---
**Author:** ![wojtek.wajerowicz](https://avatars.discourse-cdn.com/v4/letter/w/85f322/32.png) [@wojtek.wajerowicz](https://community.sonarsource.com/u/wojtek.wajerowicz)\ **Post date:** [January 25, 2024, 7:51am UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/14 "2024-01-25T07:51:20Z")
@RyanH I don’t think we have enough information in the database about which projects had incorrect permissions/visibility applied and which ones were manually changed. Fixing this in DB schema migration is not really feasible. ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [January 29, 2024, 10:37pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/18 "2024-01-29T22:37:25Z")
That’s understandable. I suppose what I am driving at is, how do we fix the projects which are currently in this broken state? Will the release notes include documentation on how to do this, or is this something you can help us with or should do before the 10.4 release? Thanks! ---
**Author:** ![wojtek.wajerowicz](https://avatars.discourse-cdn.com/v4/letter/w/85f322/32.png) [@wojtek.wajerowicz](https://community.sonarsource.com/u/wojtek.wajerowicz)\ **Post date:** [January 30, 2024, 9:01am UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/19 "2024-01-30T09:01:38Z")
Hi @RyanH, An admin can go to **Administration → Projects → Management** , select projects that are in an incorrect state, and `Bulk Apply Permission Template` to update permissions on the selected projects. After that it should be possible to update the visibility for each project in **Project Settings → Permissions**. ---
**Author:** ![RyanH](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ryanh/32/33860_2.png) [@RyanH](https://community.sonarsource.com/u/RyanH)\ **Post date:** [January 31, 2024, 6:39pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/20 "2024-01-31T18:39:50Z")
@wojtek.wajerowicz Ah, thanks! That fixed the broken projects. ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [February 7, 2024, 6:40pm UTC](https://community.sonarsource.com/t/issue-with-importing-github-projects-in-10-3/106081/21 "2024-02-07T18:40:44Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.