From 6d3ef65b15f7753b72385f0d09ea617a41957f20 Mon Sep 17 00:00:00 2001 From: Dave Mihalcik Date: Tue, 20 Oct 2026 16:43:46 -0400 Subject: [PATCH] chore(ci): skip Sonar analysis when SONAR_TOKEN is unavailable Dependabot and fork PRs can't read the SONAR_TOKEN secret, so the Sonar goal in mavenverify fails with "Not authorized" after the tests have passed, and the PR shows red. Pass -Dsonar.skip when the token is empty so the job reflects the build and test result. Pushes to main and same-repo PRs still run the analysis. Also pass GITHUB_TOKEN to buf-setup-action in the CodeQL workflow, as checks.yaml already does; without it the action calls the GitHub API unauthenticated and can fail on the shared runner rate limit. Signed-off-by: Dave Mihalcik --- .github/workflows/checks.yaml | 5 +++++ .github/workflows/codeql.yaml | 2 ++ 2 files changed, 7 insertions(+) diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml index e4ca46f9b..5467ad18c 100644 --- a/.github/workflows/checks.yaml +++ b/.github/workflows/checks.yaml @@ -105,8 +105,13 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} run: | + # Dependabot and fork PRs can't read SONAR_TOKEN; skip the analysis + # there instead of failing the job after the tests pass. + SONAR_SKIP=false + if [ -z "$SONAR_TOKEN" ]; then SONAR_SKIP=true; fi mvn --batch-mode verify \ org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ + -Dsonar.skip="$SONAR_SKIP" \ -Dmaven.antrun.skip -Dsonar.projectKey=opentdf_java-sdk \ -P 'coverage,non-fips,!fips' diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index dd42d9f82..d013aad86 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -25,6 +25,8 @@ jobs: - name: Buf setup uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Initialize the CodeQL tools for scanning uses: github/codeql-action/init@v3