sonar

[lithium147]

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 SonarQube scan step missing required SONAR_HOST_URL and SONAR_TOKEN configuration

The SonarSource/sonarqube-scan-action@v7.0.0 requires SONAR_HOST_URL and SONAR_TOKEN to be set as environment variables (typically from GitHub secrets). Neither is configured in this step via env: block. There is also no sonar-project.properties file in the repository to provide the host URL. Without these, the action will fail at runtime, and since continue-on-error is not set, this will cause the entire CI build to fail on every push/PR to main.

Prompt for agents

In .github/workflows/maven.yml, the SonarQube scan step (lines 31-34) needs required configuration. At minimum:

1. Add an `env:` block to the step with SONAR_HOST_URL and SONAR_TOKEN from GitHub secrets:
    - name: Official SonarQube Scan
      uses: SonarSource/sonarqube-scan-action@v7.0.0
      env:
        SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

2. Create a sonar-project.properties file in the repository root with at least:
   sonar.projectKey=<your-project-key>

3. Alternatively, pass the project key via the `args` input of the action.

4. Make sure the corresponding secrets (SONAR_HOST_URL and SONAR_TOKEN) are configured in the GitHub repository settings.

---

Was this helpful? React with 👍 or 👎 to provide feedback.