Template for a good new topic, formatted with Markdown:
ALM used: GitLab
CI system used: GitLab
Error observed :
Project Admins are not able to bind existing sonar projects to a Gitlab project. Even though the setting is available to project admins, the gitlab project list appears empty.
Org Admins can see the full list of available gitlab projects.
When visiting Administration → General Settings → Repository Binding, in the background the call to: https://api.sonarcloud.io/dop-translation/dop-repositories?organizationId=XXXX fails with 404
Potential workaround
Only works for Org Admins
Is this intended? It would be great if Project Admins could bind their own projects without support of an Org Admin.
This has been fixed, but unfortunately not in the way you expected.
We already document that you need the “Create projects” permission to be able to update a project binding.
While I understand it is inconvenient for a project admin to not be able to update their project binding, it actually prevents leakage of repositories a given project admin may not have access to on GitHub (because for now we don’t limit in SonarQube the repositories you can see if you have the “Create projects” permission).
If we were to allow project administrators (without the “Create project” permission on the organization) to update their project binding, they could bind their project to a GitHub repository called “foo”, for example, while they don’t have permission on this repository in GitHub, and that would be a security issue.
In the future, if you need to update project bindings, either ask an organization administrator to give you the “Create projects” permission, or ask an organization provisioner (user with the “Create projects” permission on the organization) to update the binding for you.
Thank you for your understanding.