I run a project where I test the reproducibility of GitHub Actions and found that v7.1.0 of the `SonarSource/sonarqube-scan-action` action is not reproducible. I confirmed this locally based on the contributing guidelines of the project by running these commands: git clone git@github.com:SonarSourc…

Hi, Apologies for not elaborating on that aspect. The term originates(?) from the https://reproducible-builds.org/ project. Intuitively it just means that given the same build input you get back “exactly” the same output. For the purposes of my original description I meant byte-for-byte identical, …

Hi Eric, Thanks for the details. I’m gonna need more. :sweat_smile: Let’s start with what differed from run to run? And could you perhaps provide the analysis logs of the two runs? The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as…

Apologies for the misunderstanding Ann, I’m not having trouble running the action, I’m having trouble (re)building the action build artifact from its source code. This is a meta-question, I’m not here as a user of the action but rather as a contributor (of sorts). As illustrated in my original pos…

Hi Eric, You’re saying that when you build our action code independently, you don’t get something with an identical checksum to what we published? Ann

Hi Ann, Probably yes? Given that the build artifact bytes changed, when I compute the checksums before and after they differ. However, I don’t know if you publish checksums for the build artifact anywhere (or if you publish the build artifact elsewhere too). Eric

Hi Eric, Thanks for clarifying. I’m going to flag this for the team that owns the build. Ann

We found it out in ASF as well (we are doing reproducibility checks ourselves) - and I even opened a PR that should address it: Add build and dist/ freshness check to CI by potiuk · Pull Request #228 · SonarSource/sonarqube-scan-action · GitHub

Hi @ericornelissen and @Jarek_Potiuk , Thank you very much for contributing to the community! I’ve handled this topic directly on @Jarek_Potiuk ’s PR on GitHub. Best

The `SonarSource/sonarqube-scan-action@7.1.0` build output is not reproducible

SonarQube Cloud

ganncamp (G Ann Campbell) April 3, 2026, 1:34pm 2

Hi,

Can you help me understand what you mean here by “reproducible”?

Thx,
Ann

Topic		Replies	Views
Github action for sonar server? Suggest new features	3	815	May 19, 2021
GitHub Actions workflow MSBuild example broken SonarQube Cloud github-actions , sonarqube-cloud	0	404	February 8, 2022
Action rebuilding Sonar Scanner container every time SonarQube Cloud github-actions , sonarqube-cloud	1	410	October 11, 2019
GithubActions sonarqube action not working after code build SonarQube Server / Community Build	4	266	June 18, 2024
Status not being correctly reported to Github SonarQube Cloud coverage	7	431	February 6, 2024

The `SonarSource/sonarqube-scan-action@7.1.0` build output is not reproducible

Related topics