Skip to content

fix(sonar): declare SONAR_TOKEN instead of inheriting every secret #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
usetheodev merged 4 commits into from
Aug 27, 2026
Merged

fix(sonar): declare SONAR_TOKEN instead of inheriting every secret #29

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d085307
feat(sonar): a reusable SonarQube Cloud analysis workflow
paulohenriquevn Aug 27, 2026
ccc02f4
docs(sonar): the scanner refuses to run beside Automatic Analysis, it…
paulohenriquevn Aug 27, 2026
6fa0c6e
fix(sonar): declare SONAR_TOKEN instead of asking callers to inherit …
paulohenriquevn Aug 27, 2026
0989254
chore: merge main — the sonar.yml from #28 plus the secret fix from #29
paulohenriquevn Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions .github/workflows/sonar.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@
#
# jobs:
# sonar:
# uses: usetheokit/shared-workflows/.github/workflows/sonar.yml@v1
# secrets: inherit
# uses: usetheokit/shared-workflows/.github/workflows/sonar.yml@v1 # zizmor: ignore[unpinned-uses]
# secrets:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# with:
# coverage-command: pnpm test:coverage
#
Expand Down Expand Up @@ -56,6 +57,16 @@ on:
description: 'Override when the repository does not install with a frozen pnpm lockfile.'
type: string
default: ''
secrets:
SONAR_TOKEN:
description: |
SonarCloud analysis token. Declared rather than inherited: `secrets: inherit` hands this
workflow EVERY secret the caller holds, and zizmor flags it for that reason. Naming the
one secret it needs is the difference between a scanner that can publish an analysis and
a scanner that could publish anything.

Optional, so a repository without the secret still runs the job — it warns and skips.
required: false

# One analysis per ref. Two scans of the same commit race for the same server-side report, and the
# loser overwrites the winner with an identical result — wasted minutes, and a confusing history.
Expand Down