Closed egorodet closed 10 months ago
Fixed by running Sonar Scan check for pull-requests from fork repositories using pull_request_target
event in CI Sonar Scan
workflow.pull_request_target
runs in context of origin repository and has access to necessary secrets. Tested on pull-requests:
egorodet/MethaneKit
MethanePowered/MethaneKit
Fix commits: 3a05cd7d0c99a0e1cbd3cb041026d9aea3625fbe, 9201030611f3a736cd3a821259f57ee7ccaedd22, 080623728ce2bcc8e7930d7ba009e10dfcd20b9c
Sonar-Scan workflow is using
SONAR_TOKEN
secret stored inMethaneKit
original repository, so when this workflow is started from forked repository which does not contain this secret, it fails. The solution is to split workflow to Sonar-Build and Sonar-Scan workflows where the first one is preparing build and test artifacts for scanning and Sonar-Scan workflow runs strictly in context of the original repository with access to the required secret.