SonarCloud Quality Gate stopped or not available in Azure DevOps branch policies

[rafalg8 (rafalg)]

Hi, recently, the policy in charge of the Quality Gate in Azure DevOps is not working as expected anymore.

I have tried, to replace all my tokens, added a new config as exposed below in the Azure Publish and prepare tasks:

 SonarCloud: "org.sonarcloud.connection"

          organization: "org"

scannerMode: "CLI"

configMode: "manual"

cliProjectKey: "org_Frontend"

cliProjectName: "org.frontend"

cliSources: "./frontend"

extraProperties: |

            sonar.pullrequest.provider=vsts

            sonar.javascript.lcov.reportPaths=frontend/coverage/**/lcov.info

            sonar.coverage.exclusions=frontend/**/*test*.ts,frontend/**/*test*.tsx,frontend/**/*spec*.ts,frontend/**/*spec*.tsx

            sonar.pullrequest.vsts.instanceUrl=$(System.TeamFoundationCollectionUri)

            sonar.pullrequest.vsts.project=$(System.TeamProject)

            sonar.pullrequest.vsts.repository=$(Build.Repository.Name)

The analysis is working as expected, furthermore I can see the quality gate in the extensions:

However, I cannot create a policy for master branch as I did in the past anymore:

Could someone help me with this?

Don’t know if is a known issue between Azure DevOps and SonarCloud version.

Thanks in advance.

[Colin]

Hey there.

Have you updated any Azure DevOps tokens on SonarQube Cloud that might have gone bad?

Troubleshooting Missing Pull Request Decoration in SonarQube Cloud

It’s a frustrating scenario: your pipeline runs, SonarQube Cloud completes its analysis, and the quality gate is green—but the results never appear on your pull request. You’ve followed all the steps, so what’s going wrong? This guide will walk you through the most frequent causes of this issue and how to resolve them. The #1 Cause: Incorrect Organization / Repository Binding More often than not, the problem lies in an incorrect or invalid configuration linking SonarQube Cloud to your DevOp…

[rafalg8 (rafalg)]

Hi Colin. Thanks for the guide. Yes, was the first I did, I regenerated the personal access token and the organization token and update it in the Azure DevOps settings.

There is some api or tool where can I verify is getting the right ones?

I clicked in the verify section and worked well.

[Colin]

I would double check that you have nothing set in the project-level settings (see here)

If that’s the case, I’ll reach out via PM for some extra details to look things up in the backend.

[rafalg8 (rafalg)]

I have followed the guide, removed the token at the project level, and redo the Sonar Cloud Policy, and is still waiting the quality gate.

[Colin]

Have you reanalyzed your PR?

And, the screenshot you’re sharing is at the org-level, not the project level.

[rafalg8 (rafalg)]

yes, even tried to abandon and republish the Pull request without success,

that is my currently config at project level:

Verified also the project repo is bound to Azure:

Thanks

[Colin]

I’ve sent you a PM

[rafalg8 (rafalg)]

Still not working.

I have removed the project associated tokens, and only using Orngaization valid token and still not working as expected

[dmcdaniel (McDaniel, Darren)]

I’ve had this exact scenario happen over the last few days… Projects that were reporting successfully suddenly just stopped…. I would appreciate being a part of this troubleshooting effort as well. Difference being we’re using Sonarqube Server..

[rafalg8 (rafalg)]

Could someone from SonarCloud clarify is this token is needed?

Because I found in different places different tokens, one documentation says about Organization token, same as PAT, other said specific project token, like this:

And other guides, says SONAR_TOKEN used for environment variables for use as Other configuration.

I have a problem between SonarCloud and Azure DevOps, not Azure DevOps to –> SonarCloud.

For some reason, the SonarCloud is not reaching the PR and didn’t decorate it, however I can see the analysis in the extensions of the pipeline and also in SonarCloud.

Need some assistance please.

Thanks in advance.

labs/vstsextend/sonarcloud/readme.md

[rafalg8 (rafalg)]

Seems the token is mandatory write code permissions for the Pull Requests section in Azure DevOps, after that, is working again. Could someone clarify the difference between PAT TOKEN at project level, and Organization Token level? Can be reused for all the projects?

**Scoped Organization Tokens
**
Can it be used for Pull request decorator?

[Colin]

Hey @rafalg8

@rafalg8

Seems the token is mandatory write code permissions for the Pull Requests section in Azure DevOps, after that, is working again.

This is what you had to check, right? Just want to make sure nothing has changed (this is what is documented)

@rafalg8

Could someone clarify the difference between PAT TOKEN at project level, and Organization Token level? Can be reused for all the projects?

The PAT token at the project level simply overrides the organization token. It is legacy that the project-level token exists at all, but it is hard to remove something once it’s added.

@rafalg8

**Scoped Organization Tokens
**
Can it be used for Pull request decorator?

SOTs are SonarQube Cloud tokens, while what you’re talking about is an Azure DevOps Token.

[rafalg8 (rafalg)]

Yes, was documented I misunderstood it.

Regarding the PAT and tokens, there is some way to reuse same PAT for the communication between Sonar and Azure DevOps, which the PAT can be reusable by all the projects below same organization using same token?

I assume like this? Importing Azure DevOps organization | SonarQube Cloud | Sonar Documentation

It can be possible simply use Azure Service connection and managed through it, instead a Personal Acces Token which will be outdate each 90 days?

Thanks

[Colin]

The PAT set at the org-level is automatically used by projects with no project-level token defined.

@rafalg8

It can be possible simply use Azure Service connection and managed through it, instead a Personal Acces Token which will be outdate each 90 days?

It’s something on our roadmap.