SonarCloud 2025: Pull request decoration of fork not working with GitHub

Hi,

after some time I tried again the “pull request decoration with GitHub”. My Java code is on GitHub, I’m using GitHub Actions with Maven. To create the YAML file I was using your assistant:

The result is

Create or update your .github/workflows/build.yml

Here is a base configuration to run a SonarQube Cloud analysis on your master branch and Pull Requests. If you already have some GitHub Actions, you might want to just add some of these new steps to an existing one.

name: SonarQube
on:
  push:
    branches:
      - master
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  build:
    name: Build and analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: 'zulu' # Alternative distribution options are available.
      - name: Cache SonarQube packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Cache Maven packages
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2
      - name: Build and analyze
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=org.sonarsource.sonarqube-plugins.xyz:xyz

The problem seems to be that the SONAR_TOKEN is not accessible in the fork docs.

Looking here the feature should work now with 2025 LTS https://portal.productboard.com/sonarsource/1-sonarqube-cloud/c/50-sonarcloud-analyzes-external-pull-request

What I’m doing wrong?

Regards,

Hey Gunter,

As the roadmap item notes:

SonarCloud is now able to scan External Pull Requests when the project is configured to be scanned with Automatic Analysis (https://docs.sonarsource.com/sonarcloud/advanced-setup/automatic-analysis/).

What you’ve outlined here is CI-based analysis, which still has the limitation you’ve mentioned (SONAR_TOKEN not available in the forked PR pipeline run)