We’re using SonarCloud with a Bitbucket Cloud monorepo, and we’ve run into a workflow gap that we think would benefit other monorepo users. We’d like to share what we found and suggest an improvement.
The problem
When a CI scan arrives for a project key that doesn’t yet exist in SonarCloud, SonarCloud auto-provisions it as a standard (non-monorepo) project. For a monorepo, this means the project isn’t bound to the repo as part of the monorepo, so its quality gate never decorates the pull request in Bitbucket even though the scan completes successfully. Developers only notice later, when PR decoration is silently missing for that app.
Why it’s hard to correct after the fact
Once the standard project has been auto-created, there’s no self-serve way to fold it into the existing monorepo:
- The per-project Repository binding page hard-blocks selecting a repo that already backs a monorepo (the entry is greyed out with a lock icon).
- The monorepo setup wizard only creates new projects, so reusing the existing key returns “project key is already taken.”
The only workaround we found is to delete the auto-created project and recreate it through the monorepo wizard with the same key. In doing so, we lose the project’s original analysis history.
What would help
We understand SonarCloud can’t infer monorepo membership from a scan, so auto-creating it correctly isn’t feasible. What would solve this for us is the ability to prevent analysis-time project creation entirely, so that a scan for a non-existent key fails cleanly rather than silently creating a misconfigured standard project. That would let us provision each monorepo project properly first, then let scans flow in.
We’re aware this can be partially managed today via analysis token permissions (e.g. project-scoped tokens without Create Projects permission). But an explicit organization-level setting to disable analysis-time project creation — similar to the provisioning control in self-hosted SonarQube Server — would be a much clearer and more reliable guardrail.
Could you let us know whether such a control exists today that we may have missed, and if not, whether this is something you’d consider adding? Happy to provide more detail or logs if useful.