[Bug] Sonar scan no longer work on PRs

[tschaffter]

Is there an existing issue for this?

• [X] I have searched the existing issues

What product(s) are you seeing the problem on?

Sage Monorepo

Current behavior

The HEAD and BASE SHAs are now the same, which makes Nx believes that no projects are affected. Sonar still works fine when pushing to main.

Expected behavior

No response

Anything else?

No response

Commit ID

No response

Are you developing inside the dev container?

• [X] I am using the dev container

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[tschaffter]

References

• https://github.com/actions/checkout?tab=readme-ov-file#checkout-v4
  • Consider specifying persist-credentials: false
• https://github.com/actions/checkout/issues/518
  • This is exactly the issue we have when using pull_request_target. No solution yet.
• One approach is described here. A potential risk is that the workflow may run newer code that has been pushed after the workflow started running.
• https://gist.github.com/fxmarty/fba1ea3b2ebbf9a75cca71c08f05a85b
  • https://dvc.ai/blog/testing-external-contributions-using-github-actions-secrets
• Checkout PR commit (not merge commit) + configure GitHub to "Require branches to be up to date before merging"?