MethanePowered / MethaneKit

🎲 Modern 3D graphics made simple with C++17 cross-platform framework and rendering abstraction API on top of DirectX 12, Metal & Vulkan
Apache License 2.0
846 stars 51 forks source link

Sonar-Scan workflow fails for external pull-requests #124

Closed egorodet closed 9 months ago

egorodet commented 1 year ago

Sonar-Scan workflow is using SONAR_TOKEN secret stored in MethaneKit original repository, so when this workflow is started from forked repository which does not contain this secret, it fails. The solution is to split workflow to Sonar-Build and Sonar-Scan workflows where the first one is preparing build and test artifacts for scanning and Sonar-Scan workflow runs strictly in context of the original repository with access to the required secret.

egorodet commented 9 months ago

Fixed by running Sonar Scan check for pull-requests from fork repositories using pull_request_target event in CI Sonar Scan workflow.pull_request_target runs in context of origin repository and has access to necessary secrets. Tested on pull-requests:

Fix commits: 3a05cd7d0c99a0e1cbd3cb041026d9aea3625fbe, 9201030611f3a736cd3a821259f57ee7ccaedd22, 080623728ce2bcc8e7930d7ba009e10dfcd20b9c