# :sonar task failing on Kotlin Multiplatform project **URL:** \ **Category:** SonarQube Cloud\ **Tags:** sonarqube\ **Created:** [June 28, 2025, 7:03pm UTC](https://community.sonarsource.com/t/sonar-task-failing-on-kotlin-multiplatform-project/143666 "2025-06-28T19:03:43Z")\ **Posts on this page:** 1\ **Showing post:** 6
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [June 30, 2025, 4:21pm UTC](https://community.sonarsource.com/t/sonar-task-failing-on-kotlin-multiplatform-project/143666/6 "2025-06-30T16:21:43Z")
After digging into your repo, I think I have a better understanding of what’s happening. You were likely impacted by this change: > [@locked\_with\_key Important Security Update: Removal of the “Anyone” Group](https://community.sonarsource.com/t/important-security-update-removal-of-the-anyone-group/143104): > > Dear community, As part of our commitment to keeping your organization’s data secure, we are removing the Anyone group from SonarQube Cloud. The Anyone group was not aligned to the explicit Members group model and did not effectively communicate who was granted access when in use. The removal of the Anyone group is a proactive security measure – we’d like to assure you that we haven’t identified any exploitation of this group by malicious users. What’s changing: The Anyone group will no long… Since your PRs come from forked repos, they don’t have access to the `SONAR_TOKEN` repository secret. My guess is you may have been relying on the **Anyone** permission as a workaround, and this workaround stopped working two weeks ago. ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/d/2/d2c4561299ecd2dcd4ceabb103ca1be2088872fd.png) SonarQube Cloud doesn’t support analysis on forked PRs particularly well, which is a shame as it makes it hard to support open-source development workflows. In those situations, we generally recommend [Automatic Analysis](https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/automatic-analysis/), though you should be aware that some features like code coverage might not be available. Some users have come up with creative solutions to address this (without exposing a SonarQube Cloud token). Here’s a recent example: > [@Configuring a secured GitHub workflow to launch a Sonar analysis for PR from forks](https://community.sonarsource.com/t/configuring-a-secured-github-workflow-to-launch-a-sonar-analysis-for-pr-from-forks/141898/9): > > So, as promised, here is how we managed to get a Sonar analysis on a PR based on a fork. We now have 3 CI workflows: “CI”: the usual one that works only on PR from inside our repository and therefore can access the secrets “CI on forks - build and tests”: the workflow that run only on PR from forks. It does all the parts that do not require access to the secrets (building and testing) “CI on forks - Sonar analysis”: this workflow is triggered only when the “CI on forks - build and tests” succ… --- _[View the full topic](https://community.sonarsource.com/t/sonar-task-failing-on-kotlin-multiplatform-project/143666)._