SONAR_TOKEN permissions in pull request GitHub Actions

[Colin]

It’s a PR from a fork… which I guess we’ve taken to calling “external PRs” internally.

Some users have crafted some complicated workarounds. You’re welcome to take a look.

How to use SonarCloud with a forked repository on GitHub?

Hello all– After much struggle, we now have a Github repo that can run SonarCloud analysis on pull requests from forks. The trick is the “workflow_run” feature from Github Actions: In short, you need 2 separate Github Actions: Build step - Build your project, run tests, upload code coverage. This step does not have access to any Github secrets such as SONAR_TOKEN. Sonar step - Download code coverage from previous step, and run the SonarCloud analysis. This step does have access to SONAR_…

This is a topic we’re sure we’ll address someday, but unfortunately, it keeps getting bumped.