# Sonar cannot be run on PR from a fork **URL:** \ **Category:** SonarQube Cloud\ **Created:** [August 3, 2022, 6:30pm UTC](https://community.sonarsource.com/t/sonar-cannot-be-run-on-pr-from-a-fork/69229 "2022-08-03T18:30:44Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Chris\_Caspanello](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/chris_caspanello/32/1586_2.png) [@Chris\_Caspanello](https://community.sonarsource.com/u/Chris_Caspanello)\ **Post date:** [August 3, 2022, 6:30pm UTC](https://community.sonarsource.com/t/sonar-cannot-be-run-on-pr-from-a-fork/69229/1 "2022-08-03T18:30:44Z")
When I make a PR from a branch internal to my organization Sonar runs fine. But if a fork is created and a PR is made from that fork I get the following error: > Error: Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184:sonar (default-cli) on project todo-backend: Project not found. Please check the ‘sonar.projectKey’ and ‘sonar.organization’ properties, the ‘SONAR\_TOKEN’ environment variable, or contact the project administrator → [Help 1] This is because GitHub does not pass secret per documentation: > Note: With the exception of GITHUB\_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository. Does anyone have a better suggestion / work around? ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [August 4, 2022, 7:21am UTC](https://community.sonarsource.com/t/sonar-cannot-be-run-on-pr-from-a-fork/69229/2 "2022-08-04T07:21:48Z")
This is not possible out-of-the-box, but some users have found a workaround. > [@How to use SonarCloud with a forked repository on GitHub?](https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/30): > > Hello all– After much struggle, we now have a Github repo that can run SonarCloud analysis on pull requests from forks. The trick is the “workflow\_run” feature from Github Actions: In short, you need 2 separate Github Actions: Build step - Build your project, run tests, upload code coverage. This step does not have access to any Github secrets such as SONAR\_TOKEN. Sonar step - Download code coverage from previous step, and run the SonarCloud analysis. This step does have access to SONAR\_… You may also want to vote on this roadmap item here: [https://portal.productboard.com/sonarsource/1-sonarcloud/c/50-sonarcloud-analyzes-external-pull-request](https://portal.productboard.com/sonarsource/1-sonarcloud/c/50-sonarcloud-analyzes-external-pull-request) ---
**Author:** ![c-schmitz](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/c-schmitz/32/37923_2.png) [@c-schmitz](https://community.sonarsource.com/u/c-schmitz)\ **Post date:** [October 28, 2022, 9:24am UTC](https://community.sonarsource.com/t/sonar-cannot-be-run-on-pr-from-a-fork/69229/3 "2022-10-28T09:24:09Z")
This seems to be the 2nd highest voted item. Any chance that this gets fixed/implemented, actually? ---
**Author:** ![boyan-velinov](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/boyan-velinov/32/49987_2.png) [@boyan-velinov](https://community.sonarsource.com/u/boyan-velinov)\ **Post date:** [October 16, 2023, 1:16pm UTC](https://community.sonarsource.com/t/sonar-cannot-be-run-on-pr-from-a-fork/69229/4 "2023-10-16T13:16:06Z")
Hello, Is there any workaround for that when someone is working with PRs from forks? ---
**Author:** ![SamBarker](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sambarker/32/55359_2.png) [@SamBarker](https://community.sonarsource.com/u/SamBarker)\ **Post date:** [March 13, 2024, 1:44am UTC](https://community.sonarsource.com/t/sonar-cannot-be-run-on-pr-from-a-fork/69229/5 "2024-03-13T01:44:52Z")
There is a work around. We use it in the [Kroxylicious](https://github.com/kroxylicious/kroxylicious/) project. The work around is clunky but it works. The basic scheme is to run the actual Sonar scan in the project rather than PR context (i’m not sure what the proper GitHub terminology is). To do that our PR build uploads a text file containing the PR number. We then have a dependent build job which pulls that down, and then checkouts the PR and runs the sonar scan on that. The dependent build is our [sonar.yaml](https://github.com/kroxylicious/kroxylicious/blob/ea01176b060261926b03da95ebdfa4ad7b8e8f6c/.github/workflows/sonar.yaml) and you can find the PR upload in [this snippet](https://github.com/kroxylicious/kroxylicious/blob/ea01176b060261926b03da95ebdfa4ad7b8e8f6c/.github/workflows/maven.yaml#L65C5-L73C30). HTH