Repository navigation
standards sonarcloud.yml passes the required check when SONAR_TOKEN is unavailable, so fork PRs skip analysis permanently #1390
Description
The required SonarCloud job treats unavailable credentials as a successful omission of analysis. Fork pull requests cannot receive the repository token, so the advertised bootstrap exception continues to apply to fork changes after token configuration.
Location: standards/workflows/sonarcloud.yml:52
Severity: low · Rule: security_misconfiguration · Reachability: external
Subsystem: Deployable workflow and security policy templates
Evidence
- Source/control: A contributor's fork pull request targeting main.
- Sink/decision: The required SonarCloud Actions job can complete successfully after both analysis steps are skipped.
- Missing mitigation: The required job has no check that analysis actually ran before reporting success, and no separate credential-safe fork-analysis path.
Reachability call stack
- standards/workflows/sonarcloud.yml:25 — receives the fork PR event.
- standards/workflows/sonarcloud.yml:38 — resolves the unavailable secret to an empty value.
- standards/workflows/sonarcloud.yml:52 — skips the initial analysis.
- standards/workflows/sonarcloud.yml:56 — skips the retry.
- standards/workflows/sonarcloud.yml:32 — reports the successful SonarCloud job context.
- standards/rulesets/code-quality.json:27 — accepts that required context.
Filed from a CodeRabbit security scan (scan 2d23b5ee-606a-403f-b407-81ddebdb0115, revision 1ea9ee1fbecc). Finding IDs: cdc11afe-73d8-44bb-a24b-794710ad6911. CodeRabbit notes that findings relying on its stated assumptions are capped at medium severity; dismiss if an assumption does not hold.
Activity
fix(security): scope SONAR_TOKEN to scan steps and fail unanalysed fo…
fix(sonarcloud): fail fork PRs before any SONAR_BOOTSTRAP exemption (#…