From fc9e47894eab01dd84fac5f625fef863a47e16ff Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 19:04:08 -0400
Subject: [PATCH] ci(sonar): skip SonarCloud scan on fork pull requests (#48)

GitHub does not expose repository secrets (including SONAR_TOKEN) to pull
requests opened from forks. Because the reusable sonarcloud.yml declared
SONAR_TOKEN as a required secret and sonar-scan.yml called it with
`secrets: inherit` on every pull_request, fork PRs failed immediately with:

  Error when evaluating 'secrets' ... Secret SONAR_TOKEN is required, but not
  provided while calling.

This made every fork PR show a failing "SonarCloud Scan" check unrelated to the
PR's contents. (The separate SonarCloud GitHub App check, "SonarCloud Code
Analysis", is unaffected and continues to run.)

Fixes:
- Gate the caller job so it only runs on pushes to main and on same-repo PRs;
  fork PRs now report a neutral skipped status instead of a hard failure.
- Make SONAR_TOKEN optional in the reusable workflow and guard the scan step on
  the token being present, so a missing token never fails the workflow.

Verified with actionlint.
---
 .github/workflows/sonar-scan.yml |  7 +++++++
 .github/workflows/sonarcloud.yml | 14 +++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
index a6904c9..d09bc90 100644
--- a/.github/workflows/sonar-scan.yml
+++ b/.github/workflows/sonar-scan.yml
@@ -15,5 +15,12 @@ concurrency:
 
 jobs:
   sonarcloud:
+    # SonarCloud needs the SONAR_TOKEN secret, which GitHub does not expose to
+    # pull requests from forks. Skip the scan for fork PRs so they report a
+    # neutral "skipped" status instead of a hard failure; it still runs on pushes
+    # to main and on same-repo pull requests.
+    if: >-
+      github.event_name == 'push' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     uses: ./.github/workflows/sonarcloud.yml
     secrets: inherit
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index b791410..6deb2de 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -11,7 +11,7 @@ on:
     secrets:
       SONAR_TOKEN:
         description: "SonarCloud analysis token"
-        required: true
+        required: false
 
 permissions:
   contents: read
@@ -25,7 +25,19 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      - name: Check for SonarCloud token
+        id: token
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          if [ -n "$SONAR_TOKEN" ]; then
+            echo "available=true" >>"$GITHUB_OUTPUT"
+          else
+            echo "available=false" >>"$GITHUB_OUTPUT"
+            echo "::notice::SONAR_TOKEN is not available (e.g. a fork pull request); skipping SonarCloud scan."
+          fi
       - name: SonarCloud Scan
+        if: steps.token.outputs.available == 'true'
         uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}