Scanning GitHub pull requests using Maven

SonarQube Cloud
, , ,
1

I have my project set up on SonarCloud and scanning manually. I’m trying to introduce pull request scanning, but can’t quite figure out how to pass the SONAR_TOKEN to the job.

I have the token set up in my GitHub project as a secret, but secrets are not passed into pull requests that come from other forks due to security reasons.

How do I get around this so that my pull requests get scanned?

2

Hi,

Welcome to the community!

Are you using GitHub Actions? Maybe the docs will help.

 
Ann

3

Yes I am using GitHub actions and I have read the docs.

4

GitHub actions do not populate secrets for pull requests that come from forks, so I’m not sure how this is supposed to work.

5

Hi,

Ah. Yes, we really don’t support analyzing forks well. We’re aware of the gap.

 
Ann

7

Thats quite a gap to be honest.

11

Hi Eric,

Thanks for bringing this up, your feedback is well-noted and we are considering options to improve our support of external Pull Requests.

Regards,
Nour