Skip to content

ci(sonarqube): pass with a notice when SONAR_TOKEN is not configured #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Nov 10, 2026
+22 −0
Merged

ci(sonarqube): pass with a notice when SONAR_TOKEN is not configured #84

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
635151b
ci(sonarqube): pass with a notice when SONAR_TOKEN is not configured
claude Nov 10, 2026
6a9b85a
Merge remote-tracking branch 'origin/main' into claude/sonarqube-toke…
claude Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/sonarqube.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,33 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Report configuration state
id: cfg
# A job-level `if:` cannot read a secret. This step reads the token
# and gives the result to the steps after it. The token is in the
# environment of this step and of the scan step only.
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Check warning on line 31 in .github/workflows/sonarqube.yml

View workflow job for this annotation

GitHub Actions / Hypatia neurosymbolic scan 

[hypatia] job `sonarqube` in .github/workflows/sonarqube.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring
# The script of this step is Bash. `shell: bash` says so in the step:
# a default shell or a runner with a different shell cannot change it.
shell: bash
run: |
if [ -z "${SONAR_TOKEN}" ]; then
echo "configured=false" >> "$GITHUB_OUTPUT"
echo "::notice::SONAR_TOKEN is not configured for this repository - skipping the CI-based scan."
echo "SonarCloud automatic analysis (check: 'SonarCloud Code Analysis') is unaffected."
echo "To enable this scan: Settings > Secrets and variables > Actions > new secret SONAR_TOKEN."
else
echo "configured=true" >> "$GITHUB_OUTPUT"
echo "SONAR_TOKEN present - running the CI-based scan."
fi
- name: Checkout
if: steps.cfg.outputs.configured == 'true'
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # full history for accurate new-code detection
- name: SonarQube Scan
if: steps.cfg.outputs.configured == 'true'
uses: SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65 # v8.4.1
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
Loading