:sonar task failing on Kotlin Multiplatform project

[mcpierce (Darryl L. Pierce)]

Our project’s scans are consistently failing with the following sample output:

2025-06-28T18:49:09.8607179Z > Task :sonar
2025-06-28T18:49:09.8607509Z CPD Executor 11 files had no CPD blocks
2025-06-28T18:49:09.8607887Z CPD Executor Calculating CPD for 25 files
2025-06-28T18:49:09.8608258Z SCM writing changed lines
2025-06-28T18:49:09.8609639Z File '/home/runner/work/variant/variant/shared/src/commonMain/kotlin/org/comixedproject/variant/model/state/DownloadingState.kt' was detected as changed but without having changed lines
2025-06-28T18:49:09.8611523Z File '/home/runner/work/variant/variant/androidVariant/src/main/java/org/comixedproject/variant/android/Fixtures.kt' was detected as changed but without having changed lines
2025-06-28T18:49:09.8613459Z File '/home/runner/work/variant/variant/androidVariant/src/main/java/org/comixedproject/variant/android/view/comics/ComicBookListItemView.kt' was detected as changed but without having changed lines
2025-06-28T18:49:09.8615505Z File '/home/runner/work/variant/variant/shared/src/commonMain/kotlin/org/comixedproject/variant/app/KoinCommon.kt' was detected as changed but without having changed lines
2025-06-28T18:49:09.8617351Z File '/home/runner/work/variant/variant/shared/src/commonMain/kotlin/org/comixedproject/variant/model/library/DirectoryEntry.kt' was detected as changed but without having changed lines
2025-06-28T18:49:09.8618563Z SCM writing changed lines (done) | time=214ms
2025-06-28T18:49:10.4607155Z Analysis report generated in 2352ms, dir size=410 KB
2025-06-28T18:49:10.4607556Z Analysis report compressed in 47ms, zip size=132 KB
2025-06-28T18:49:10.9607159Z 
2025-06-28T18:49:10.9607596Z > Task :sonar FAILED
2025-06-28T18:49:11.0610867Z 
2025-06-28T18:49:11.0611372Z AAPT2 aapt2-8.10.0-12782657-linux Daemon #0: shutdown
2025-06-28T18:49:11.0612594Z FAILURE: Build failed with an exception.
2025-06-28T18:49:11.0613093Z AAPT2 aapt2-8.10.0-12782657-linux Daemon #1: shutdown
2025-06-28T18:49:11.0614703Z 
2025-06-28T18:49:11.0615210Z Android Lint: Disposing Uast application environment in lint classloaders [31.10.0_false, 31.10.0_true]
2025-06-28T18:49:11.0616417Z * What went wrong:
2025-06-28T18:49:11.0616831Z Build 0dceb4ce-ec9a-4ede-aea4-312ffa714ce4 is closed
2025-06-28T18:49:11.0618041Z Execution failed for task ':sonar'.
2025-06-28T18:49:11.0619012Z [Incubating] Problems report is available at: file:///home/runner/work/variant/variant/build/reports/problems/problems-report.html
2025-06-28T18:49:11.0624836Z > Project not found. Please check the 'sonar.projectKey' and 'sonar.organization' properties, the 'SONAR_TOKEN' environment variable, or contact the project administrator to check the permissions of the user the token belongs to

The project key is " comixed_variant" and the organization is “comixed” in our Gradle configuration.

sonar {
    properties {
        property("sonar.projectKey", "comixed_variant")
        property("sonar.organization", "comixed")
        property("sonar.host.url", "https://sonarcloud.io")
        property("sonar.gradle.skipCompile", true)
        property("sonar.exclusions", "**/gradle.build.kts,**/build/**")
    }
}

Things were working fine then all of a sudden stopped working at all.

[Colin]

Hey @mcpierce

I assume that you are providing a SONAR_TOKEN variable with a user token generated on SonarQube Cloud.

Does the user for whom SONAR_TOKEN was provisioned have Execute Analysis permissions on the project in question?

If you aren’t sure, you can try generating a new token on a user where you have confirmed these permissions.

[mcpierce (Darryl L. Pierce)]

I went into the project and granted myself across the board permissions (Administer Issues, Administer Security Hotspots, Administer, and Execute Analysis). I then reran my failing PR and it is STILL failing with:

> Task :sonar FAILED
Failed to query JRE metadata: GET https://api.sonarcloud.io/analysis/jres?os=linux&arch=x86_64 failed with HTTP 401. Please check the property sonar.token or the environment variable SONAR_TOKEN.

In my My Account → Security I previously generated a token (named sonar_token_github) and copied that value over to the Github site. It’s stored there under Settings → Secrets and varianbles → Actions → Repository Secrets → SONAR_TOKEN. The Github action is running the test with:

      - name: Build and analyze
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew build check sonar -Dsonar.gradle.skipCompile=true -Dsonar.projectKey=comixed_variant

which can be seen here.

[mcpierce (Darryl L. Pierce)]

I also ran the build locally with the following command line:

-> % ./gradlew build check sonar -Dsonar.gradle.skipCompile=true -Dsonar.projectKey=comixed_variant -Dsonar.token=$SONAR_TOKEN
Calculating task graph as no cached configuration is available for tasks: build check sonar
Type-safe project accessors is an incubating feature.
No input file found for /Users/darryl_pierce/Repositories/comixed/variant/shared/build.gradle.kts. No android lint issues will be imported on this file.
No input file found for /Users/darryl_pierce/Repositories/comixed/variant/androidVariant/build.gradle.kts. No android lint issues will be imported on this file.
No input file found for /Users/darryl_pierce/Repositories/comixed/variant/gradle/wrapper/gradle-wrapper.properties. No android lint issues will be imported on this file.
No input file found for /Users/darryl_pierce/Repositories/comixed/variant/androidVariant/build.gradle.kts. No android lint issues will be imported on this file.

BUILD SUCCESSFUL in 45s
211 actionable tasks: 3 executed, 208 up-to-date
Configuration cache entry discarded because incompatible task was found: 'task `:sonar` of type `org.sonarqube.gradle.SonarTask`'.

I used the same token here as in Github and it’s working.

That said, the Github build still is failing.

[Colin]

After digging into your repo, I think I have a better understanding of what’s happening.

You were likely impacted by this change:

Important Security Update: Removal of the “Anyone” Group

Dear community, As part of our commitment to keeping your organization’s data secure, we are removing the Anyone group from SonarQube Cloud. The Anyone group was not aligned to the explicit Members group model and did not effectively communicate who was granted access when in use. The removal of the Anyone group is a proactive security measure – we’d like to assure you that we haven’t identified any exploitation of this group by malicious users. What’s changing: The Anyone group will no long…

Since your PRs come from forked repos, they don’t have access to the SONAR_TOKEN repository secret. My guess is you may have been relying on the Anyone permission as a workaround, and this workaround stopped working two weeks ago.

SonarQube Cloud doesn’t support analysis on forked PRs particularly well, which is a shame as it makes it hard to support open-source development workflows. In those situations, we generally recommend Automatic Analysis, though you should be aware that some features like code coverage might not be available.

Some users have come up with creative solutions to address this (without exposing a SonarQube Cloud token). Here’s a recent example:

Configuring a secured GitHub workflow to launch a Sonar analysis for PR from forks

So, as promised, here is how we managed to get a Sonar analysis on a PR based on a fork. We now have 3 CI workflows: “CI”: the usual one that works only on PR from inside our repository and therefore can access the secrets “CI on forks - build and tests”: the workflow that run only on PR from forks. It does all the parts that do not require access to the secrets (building and testing) “CI on forks - Sonar analysis”: this workflow is triggered only when the “CI on forks - build and tests” succ…

[mcpierce (Darryl L. Pierce)]

That’s a lot of hacking about Github actions to implement and maintain. I think allowing automatic analysis without coverage is sufficient.

[mcpierce (Darryl L. Pierce)]

I’ve switched analysis and now I see this:

> Task :shared:verifyCommonMainVariantDbMigration
Changing log factory from null to null
java.lang.Throwable
	at com.intellij.openapi.diagnostic.Logger.logFactoryChanged(Logger.java:79)
	at com.intellij.openapi.diagnostic.Logger.setFactory(Logger.java:70)
	at com.alecstrong.sql.psi.core.ApplicationEnvironment.<init>(SqlCoreEnvironment.kt:50)
	at com.alecstrong.sql.psi.core.SqlCoreEnvironment.<init>(SqlCoreEnvironment.kt:77)
	at app.cash.sqldelight.core.SqlDelightEnvironment.<init>(SqlDelightEnvironment.kt:73)
	at app.cash.sqldelight.gradle.VerifyMigrationTask$VerifyMigrationAction$environment$2.invoke(VerifyMigrationTask.kt:102)
	at app.cash.sqldelight.gradle.VerifyMigrationTask$VerifyMigrationAction$environment$2.invoke(VerifyMigrationTask.kt:101)
	at kotlin.SynchronizedLazyImpl.getValue(LazyJVM.kt:74)
	at app.cash.sqldelight.gradle.VerifyMigrationTask$VerifyMigrationAction.getEnvironment(VerifyMigrationTask.kt:101)
	at app.cash.sqldelight.gradle.VerifyMigrationTask$VerifyMigrationAction.execute(VerifyMigrationTask.kt:118)
	at org.gradle.workers.internal.DefaultWorkerServer.execute(DefaultWorkerServer.java:63)
	at org.gradle.workers.internal.AbstractClassLoaderWorker$1.create(AbstractClassLoaderWorker.java:54)
	at org.gradle.workers.internal.AbstractClassLoaderWorker$1.create(AbstractClassLoaderWorker.java:48)
	at org.gradle.internal.classloader.ClassLoaderUtils.executeInClassloader(ClassLoaderUtils.java:100)
	at org.gradle.workers.internal.AbstractClassLoaderWorker.executeInClassLoader(AbstractClassLoaderWorker.java:48)
	at org.gradle.workers.internal.IsolatedClassloaderWorker.run(IsolatedClassloaderWorker.java:49)
	at org.gradle.workers.internal.IsolatedClassloaderWorker.run(IsolatedClassloaderWorker.java:30)
	at org.gradle.workers.internal.WorkerDaemonServer.run(WorkerDaemonServer.java:103)
	at org.gradle.workers.internal.WorkerDaemonServer.run(WorkerDaemonServer.java:72)
	at org.gradle.process.internal.worker.request.WorkerAction$1.call(WorkerAction.java:152)
	at org.gradle.process.internal.worker.child.WorkerLogEventListener.withWorkerLoggingProtocol(WorkerLogEventListener.java:41)
	at org.gradle.process.internal.worker.request.WorkerAction.lambda$run$1(WorkerAction.java:149)
	at org.gradle.internal.operations.CurrentBuildOperationRef.with(CurrentBuildOperationRef.java:85)
	at org.gradle.process.internal.worker.request.WorkerAction.run(WorkerAction.java:141)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at org.gradle.internal.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:36)
	at org.gradle.internal.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24)
	at org.gradle.internal.remote.internal.hub.MessageHubBackedObjectConnection$DispatchWrapper.dispatch(MessageHubBackedObjectConnection.java:182)
	at org.gradle.internal.remote.internal.hub.MessageHubBackedObjectConnection$DispatchWrapper.dispatch(MessageHubBackedObjectConnection.java:164)
	at org.gradle.internal.remote.internal.hub.MessageHub$Handler.run(MessageHub.java:414)
	at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:64)
	at org.gradle.internal.concurrent.AbstractManagedExecutor$1.run(AbstractManagedExecutor.java:48)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)


> Task :androidVariant:lintVitalAnalyzeRelease
You are running CI analysis while Automatic Analysis is enabled. Please consider disabling one or the other.
> Task :sonar FAILED
> Task :androidVariant:lintAnalyzeDebug

You can see the full log here.

Any ideas on how to fix this?

[Colin]

You are running CI analysis while Automatic Analysis is enabled. Please consider disabling one or the other.

To resolve this, you should remove the ‘sonar’ task from your Github Action workflow, as both automatic and CI-based analyses should not run simultaneously.