From 3dc392dcb5e7f5168944d0e37872156a3d320a96 Mon Sep 17 00:00:00 2001 From: Jon Hadfield Date: Mon, 21 Sep 2026 18:54:05 +0100 Subject: [PATCH] Do not fail CI when a token is unavailable. Dependabot pull requests run without repository secrets, so CODACY_PROJECT_TOKEN and SONAR_TOKEN are empty on them. The coverage upload and the SonarCloud scan then fail, and the pull request shows red although the tests passed on every platform. #114 has been sitting in that state since yesterday. Uploading coverage is best-effort, as it already is in gosn-v2, so it now continues on error. The scan cannot run at all without its token, so it is skipped when the token is absent rather than failing. The token moves to job level so the step's condition can see it. Neither changes what happens on a push to main or on a pull request from a branch, where both secrets are present. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/sonarqube.yml | 11 ++++++++++- .github/workflows/tests.yml | 4 ++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index ea31162..3ae793e 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -8,6 +8,10 @@ jobs: sonarcloud: name: SonarCloud runs-on: ubuntu-latest + # At job level so the scan step's `if` can see it: a step cannot test an + # environment variable it defines itself. + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} steps: - uses: actions/checkout@v7 with: @@ -24,7 +28,12 @@ jobs: # nosemgrep: generic.secrets.security.detected-sonarqube-docs-api-key # The hex string is this action's pinned commit SHA, not a key. Pinning # is what SonarCloud's githubactions:S7637 asks for. + # + # Skipped when SONAR_TOKEN is absent, which is the case on dependabot + # pull requests: they run without repository secrets, and a scan that + # cannot authenticate would fail the check for a reason unrelated to + # the change. + if: env.SONAR_TOKEN != '' uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 05e0ba7..da6dfa4 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -53,6 +53,10 @@ jobs: with: coverage-reports: cover.out force-coverage-parser: go + # Uploading coverage is best-effort. Dependabot pull requests run + # without repository secrets, so CODACY_PROJECT_TOKEN is empty there + # and the action fails; that should not turn a passing test run red. + continue-on-error: true if: runner.os != 'Windows' env: CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}