Dylan M. Taylor fc9e47894e ci(sonar): skip SonarCloud scan on fork pull requests (#48) ...

GitHub does not expose repository secrets (including SONAR_TOKEN) to pull
requests opened from forks. Because the reusable sonarcloud.yml declared
SONAR_TOKEN as a required secret and sonar-scan.yml called it with
`secrets: inherit` on every pull_request, fork PRs failed immediately with:

  Error when evaluating 'secrets' ... Secret SONAR_TOKEN is required, but not
  provided while calling.

This made every fork PR show a failing "SonarCloud Scan" check unrelated to the
PR's contents. (The separate SonarCloud GitHub App check, "SonarCloud Code
Analysis", is unaffected and continues to run.)

Fixes:
- Gate the caller job so it only runs on pushes to main and on same-repo PRs;
  fork PRs now report a neutral skipped status instead of a hard failure.
- Make SONAR_TOKEN optional in the reusable workflow and guard the scan step on
  the token being present, so a missing token never fails the workflow.

Verified with actionlint.

2026-10-21 19:04:08 -04:00

..

workflows

ci(sonar): skip SonarCloud scan on fork pull requests (#48)

2026-10-21 19:04:08 -04:00

dependabot.yml

Create dependabot.yml (#30)

2026-10-19 01:14:25 -04:00