From ea2cae4a03d2edd894b23a623dbd015dd01b3899 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 4 Nov 2026 17:59:19 -0500
Subject: [PATCH] Match the SonarCloud token fallback the scan actually uses
 (#139)

---
 tests/test_sonarcloud.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/test_sonarcloud.py b/tests/test_sonarcloud.py
index f3a49ba..e0c8d95 100644
--- a/tests/test_sonarcloud.py
+++ b/tests/test_sonarcloud.py
@@ -71,7 +71,12 @@ class SonarCloudTests(unittest.TestCase):
         self.assertEqual(self.validation['if'], "steps.token.outputs.available == 'true'")
         self.assertEqual(self.scan['if'], self.validation['if'])
         self.assertEqual(self.scan['env']['SONAR_HOST_URL'], 'https://sonarcloud.io')
-        self.assertEqual(self.scan['env']['SONAR_TOKEN'], '${{ secrets.SONAR_TOKEN }}')
+        # The scan consumes whatever the validation step accepted: the SonarCloud PAT when the
+        # repo has one, otherwise the plain project token.
+        self.assertEqual(
+            self.scan['env']['SONAR_TOKEN'],
+            '${{ secrets.SONAR_CLOUD_PAT || secrets.SONAR_TOKEN }}',
+        )
         self.assertEqual(
             self.scan['with']['args'].splitlines()[0],
             '"-Dsonar.projectKey=${{ steps.project.outputs.key }}" -Dsonar.organization=storytold '