# Scanning GitHub pull requests using Maven

**URL:** <https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380>\
**Category:** SonarQube Cloud\
**Tags:** github-actions, pull-request, github, scanner\
**Created:** [December 1, 2023, 8:34pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380 "2023-12-01T20:34:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![edeandrea](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/edeandrea/32/52255_2.png) [@edeandrea](https://community.sonarsource.com/u/edeandrea)\
**Post date:** [December 1, 2023, 8:34pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/1 "2023-12-01T20:34:23Z")

</div>

I have my project set up on SonarCloud and scanning manually. I’m trying to introduce pull request scanning, but can’t quite figure out how to pass the `SONAR_TOKEN` to the job.

I have the token set up in my GitHub project as a secret, but secrets are not passed into pull requests that come from other forks due to security reasons.

How do I get around this so that my pull requests get scanned?

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [December 4, 2023, 4:44pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/2 "2023-12-04T16:44:27Z")

</div>

Hi,

Welcome to the community!

Are you using GitHub Actions? Maybe [the docs](https://docs.sonarsource.com/sonarcloud/advanced-setup/ci-based-analysis/github-actions-for-sonarcloud/#github-actions-for-c-and-c) will help.

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![edeandrea](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/edeandrea/32/52255_2.png) [@edeandrea](https://community.sonarsource.com/u/edeandrea)\
**Post date:** [December 4, 2023, 5:00pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/3 "2023-12-04T17:00:23Z")

</div>

Yes I am using GitHub actions and I have read the docs.

---

<div class="post-metadata">

**Author:** ![edeandrea](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/edeandrea/32/52255_2.png) [@edeandrea](https://community.sonarsource.com/u/edeandrea)\
**Post date:** [December 4, 2023, 5:01pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/4 "2023-12-04T17:01:38Z")

</div>

GitHub actions do not populate secrets for pull requests that come from forks, so I’m not sure how this is supposed to work.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [December 4, 2023, 5:02pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/5 "2023-12-04T17:02:49Z")

</div>

Hi,

> [@edeandrea](#):
>
> from forks

Ah. Yes, we really don’t support analyzing forks well. We’re aware of the gap.

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![edeandrea](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/edeandrea/32/52255_2.png) [@edeandrea](https://community.sonarsource.com/u/edeandrea)\
**Post date:** [December 5, 2023, 12:45am UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/7 "2023-12-05T00:45:57Z")

</div>

Thats quite a gap to be honest.

---

<div class="post-metadata">

**Author:** ![nour.zerhouni](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/nour.zerhouni/32/50665_2.png) [@nour.zerhouni](https://community.sonarsource.com/u/nour.zerhouni)\
**Post date:** [December 5, 2023, 4:32pm UTC](https://community.sonarsource.com/t/scanning-github-pull-requests-using-maven/105380/11 "2023-12-05T16:32:57Z")

</div>

Hi Eric,

Thanks for bringing this up, your feedback is well-noted and we are considering options to improve our support of external Pull Requests.

Regards,  
Nour