{"id":35405098,"url":"https://github.com/vmvarela/sonarqube-ce-sarif-action","last_synced_at":"2026-03-06T09:09:35.117Z","repository":{"id":330993471,"uuid":"1124768109","full_name":"vmvarela/sonarqube-ce-sarif-action","owner":"vmvarela","description":"Convert SonarQube Community Edition issues to SARIF format for GitHub Code Scanning.","archived":false,"fork":false,"pushed_at":"2026-01-13T17:23:05.000Z","size":202,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-01-13T22:05:52.739Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://github.com/marketplace/actions/sonarqube-community-to-github-security-tab-sarif","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vmvarela.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-29T15:26:37.000Z","updated_at":"2026-01-13T17:23:06.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/vmvarela/sonarqube-ce-sarif-action","commit_stats":null,"previous_names":["vmvarela/sonarqube-ce-sarif-action"],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/vmvarela/sonarqube-ce-sarif-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmvarela%2Fsonarqube-ce-sarif-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmvarela%2Fsonarqube-ce-sarif-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmvarela%2Fsonarqube-ce-sarif-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmvarela%2Fsonarqube-ce-sarif-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vmvarela","download_url":"https://codeload.github.com/vmvarela/sonarqube-ce-sarif-action/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmvarela%2Fsonarqube-ce-sarif-action/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29988055,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T22:42:38.399Z","status":"ssl_error","status_checked_at":"2026-03-01T22:41:51.863Z","response_time":124,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-02T12:40:36.410Z","updated_at":"2026-03-06T09:09:35.095Z","avatar_url":"https://github.com/vmvarela.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🛡️ SonarQube CE → GitHub Security Tab\n\n[![CI](https://github.com/vmvarela/sonarqube-ce-sarif-action/actions/workflows/ci.yml/badge.svg)](https://github.com/vmvarela/sonarqube-ce-sarif-action/actions/workflows/ci.yml)\n[![Coverage](https://img.shields.io/badge/coverage-96%25-brightgreen)](https://github.com/vmvarela/sonarqube-ce-sarif-action)\n[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-v0-blue?logo=github)](https://github.com/marketplace/actions/sonarqube-community-to-github-security-tab-sarif)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\n**Bridge the gap between SonarQube CE and GitHub.** This GitHub Action brings PR decoration, inline annotations, and Security Tab integration to SonarQube Community Edition users.\n\n---\n\n## ✨ What You Get\n\n\u003ctable\u003e\n\u003ctr\u003e\n\u003ctd width=\"50%\"\u003e\n\n### ❌ Without This Action\n- Issues buried in SonarQube dashboard\n- No PR feedback\n- No GitHub Security integration\n- Manual context switching\n\n\u003c/td\u003e\n\u003ctd width=\"50%\"\u003e\n\n### ✅ With This Action\n- **Inline annotations** on your PR\n- **Check Run summary** with issue counts\n- Issues in **GitHub Security Tab**\n- **PR comments** with analysis results\n\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/table\u003e\n\n---\n\n## 📊 Feature Comparison\n\n| Feature | SonarQube CE | Developer+ Editions | **CE + This Action** |\n|---------|:------------:|:-------------------:|:--------------------:|\n| Code Analysis | ✅ | ✅ | ✅ |\n| PR Decoration | ❌ | ✅ | ✅ |\n| GitHub Security Tab | — | — | ✅ |\n| Inline Annotations | ❌ | ✅ | ✅ |\n| Check Run Summary | ❌ | ✅ | ✅ |\n\n---\n\n## 🚀 Quick Start (Copy \u0026 Paste)\n\n```yaml\nname: SonarQube Analysis\n\non:\n  push:\n    branches: [main]\n  pull_request:\n\njobs:\n  analyze:\n    runs-on: ubuntu-latest\n    permissions:\n      security-events: write\n      checks: write\n      pull-requests: write\n      \n    steps:\n      - uses: actions/checkout@v6\n        with:\n          fetch-depth: 0\n\n      # Your SonarQube scan (use your preferred method)\n      - name: SonarQube Scan\n        uses: sonarsource/sonarqube-scan-action@v7\n        env:\n          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}\n\n      # Convert to SARIF and get all the features ✨\n      - name: SonarQube → GitHub Security\n        uses: vmvarela/sonarqube-ce-sarif-action@v1\n        with:\n          sonar-host-url: ${{ secrets.SONAR_HOST_URL }}\n          sonar-token: ${{ secrets.SONAR_TOKEN }}\n\n      # Upload to GitHub Security Tab (only on push to default branch)\n      - name: Upload SARIF\n        if: github.event_name != 'pull_request'\n        uses: github/codeql-action/upload-sarif@v4\n        with:\n          sarif_file: sonarqube.sarif\n```\n\n**That's it!** Your PRs get inline annotations and check summaries; the Security Tab reflects the state of your default branch.\n\n---\n\n## 🎯 Features\n\n### 📝 Check Run with Annotations\n\nEvery PR gets a **Check Run** with:\n- Summary table (issues by severity/type)\n- Up to 50 inline code annotations\n- Direct link to Security Tab\n\n### 💬 PR Comments\n\nWhen issues are found, a summary comment is posted:\n- Issue counts by severity\n- Link to Security Tab (filtered by PR)\n- Auto-updates (no duplicate comments)\n\n### 🔍 Smart PR Filtering\n\nIn PR context, only shows issues from **files you changed** - not the entire project.\n\n### 🚫 Quality Gates\n\nOptionally fail the check on specific severities:\n\n```yaml\n- uses: vmvarela/sonarqube-ce-sarif-action@v1\n  with:\n    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}\n    sonar-token: ${{ secrets.SONAR_TOKEN }}\n    fail-on-severity: CRITICAL  # Fails if CRITICAL or BLOCKER issues exist\n```\n\n---\n\n## ⚙️ Configuration\n\n### Required Inputs\n\n| Input | Description |\n|-------|-------------|\n| `sonar-host-url` | Your SonarQube server URL |\n| `sonar-token` | Token with **Browse** permission |\n\n### Optional Inputs\n\n| Input | Default | Description |\n|-------|---------|-------------|\n| `project-key` | Repo name | SonarQube project key |\n| `output-file` | `sonarqube.sarif` | Output file path |\n| `min-severity` | `INFO` | Filter: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER` |\n| `fail-on-severity` | - | Fail check at this severity |\n| `pr-comment` | `true`* | Post PR comment when issues found |\n| `wait-for-processing` | `true` | Wait for SonarQube analysis to complete |\n| `processing-delay` | `0` | Fixed delay (seconds) as alternative to waiting |\n\n\\* PR comments only appear in pull request context and when issues are found.\n\n### Outputs\n\n| Output | Description |\n|--------|-------------|\n| `sarif-file` | Generated SARIF file path |\n| `issues-count` | Total issues |\n| `bugs-count` | Bug count |\n| `vulnerabilities-count` | Vulnerability count |\n| `code-smells-count` | Code smell count |\n\n\u003cdetails\u003e\n\u003csummary\u003e📋 All Outputs\u003c/summary\u003e\n\n| Output | Description |\n|--------|-------------|\n| `sarif-file` | Path to the generated SARIF file |\n| `issues-count` | Total number of issues converted |\n| `rules-count` | Number of unique rules |\n| `components-count` | Number of affected files |\n| `blocker-count` | BLOCKER severity issues |\n| `critical-count` | CRITICAL severity issues |\n| `major-count` | MAJOR severity issues |\n| `minor-count` | MINOR severity issues |\n| `info-count` | INFO severity issues |\n| `bugs-count` | BUG type issues |\n| `vulnerabilities-count` | VULNERABILITY type issues |\n| `code-smells-count` | CODE_SMELL type issues |\n| `hotspots-count` | SECURITY_HOTSPOT type issues |\n\n\u003c/details\u003e\n\n---\n\n## 🔐 Permissions\n\n### SonarQube Token\n\n| Permission | Required For |\n|------------|--------------|\n| **Browse** | ✅ Required - fetching issues |\n| Execute Analysis | Optional - for `wait-for-processing` |\n\n### GitHub Token\n\nThe action uses `GITHUB_TOKEN` automatically. Add these permissions:\n\n```yaml\npermissions:\n  security-events: write  # Upload SARIF\n  checks: write           # Create Check Run\n  pull-requests: write    # Post PR comments\n```\n\n---\n\n## 🔧 Advanced Usage\n\n### Why Skip SARIF Upload on PRs?\n\nSonarQube CE doesn't support true PR analysis—it always analyzes the main branch. In PR context, this action filters issues to changed files, but **cannot distinguish new issues from pre-existing ones**. \n\nUploading SARIF on PRs can cause:\n- **False positives**: Historical issues appearing as \"new\" in your PR\n- **Inconsistent state**: Issues \"fixed\" in PR reappearing after merge\n- **Noise**: Security Tab should reflect the default branch, not partial changes\n\n**Recommended approach**: Use Check Run annotations and PR comments for PR feedback; upload SARIF only on push/schedule to the default branch (as shown in Quick Start).\n\n### Filter by Severity\n\nOnly include MAJOR and above:\n\n```yaml\n- uses: vmvarela/sonarqube-ce-sarif-action@v1\n  with:\n    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}\n    sonar-token: ${{ secrets.SONAR_TOKEN }}\n    min-severity: MAJOR\n```\n\n### Without Execute Analysis Permission\n\nIf your token only has Browse permission:\n\n```yaml\n- uses: vmvarela/sonarqube-ce-sarif-action@v1\n  with:\n    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}\n    sonar-token: ${{ secrets.SONAR_TOKEN }}\n    wait-for-processing: false\n    processing-delay: 60  # Wait 60s for analysis\n```\n\n### Disable PR Comments\n\n```yaml\n- uses: vmvarela/sonarqube-ce-sarif-action@v1\n  with:\n    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}\n    sonar-token: ${{ secrets.SONAR_TOKEN }}\n    pr-comment: false\n```\n\n### Use Outputs in Workflow\n\n```yaml\n- name: Convert to SARIF\n  id: sarif\n  uses: vmvarela/sonarqube-ce-sarif-action@v1\n  with:\n    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}\n    sonar-token: ${{ secrets.SONAR_TOKEN }}\n\n- name: Check Results\n  run: |\n    echo \"Found ${{ steps.sarif.outputs.issues-count }} issues\"\n    echo \"Vulnerabilities: ${{ steps.sarif.outputs.vulnerabilities-count }}\"\n```\n\n---\n\n## ❓ FAQ\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWhy don't I see issues from my branch?\u003c/b\u003e\u003c/summary\u003e\n\nSonarQube CE doesn't support branch analysis. The action fetches **all project issues** and filters them to files changed in your PR. For branch-specific analysis, you need SonarQube Developer Edition.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eHow does severity mapping work?\u003c/b\u003e\u003c/summary\u003e\n\n| SonarQube | SARIF Level | GitHub Display |\n|-----------|-------------|----------------|\n| BLOCKER | error | 🔴 Critical |\n| CRITICAL | error | 🔴 High |\n| MAJOR | warning | 🟠 Medium |\n| MINOR | note | 🟡 Low |\n| INFO | note | ⚪ Info |\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWhat if my token lacks Execute Analysis permission?\u003c/b\u003e\u003c/summary\u003e\n\nUse `processing-delay` instead of `wait-for-processing`:\n\n```yaml\nwait-for-processing: false\nprocessing-delay: 60  # seconds\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eDo resolved issues disappear from GitHub?\u003c/b\u003e\u003c/summary\u003e\n\nYes! When issues are fixed and no longer in the SARIF file, GitHub automatically marks them as **Fixed** in the Security tab.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWhat's the relationship with SonarQube Quality Gates?\u003c/b\u003e\u003c/summary\u003e\n\nThis action **does not** consult SonarQube's Quality Gate. They operate independently:\n\n| Feature | SonarQube Quality Gate | This Action (`fail-on-severity`) |\n|---------|----------------------|----------------------------------|\n| **Evaluates** | Project metrics (coverage, duplications, ratings) | Issue count by severity |\n| **Defined in** | SonarQube UI/config | Workflow YAML |\n| **Fails when** | Metrics don't meet thresholds (e.g., coverage \u003c 80%) | Issues exist at/above specified severity |\n| **Scope** | Entire project | Issues (filtered to PR files if applicable) |\n\n**Using both together:**\n\n```yaml\n# Gate 1: Project health (SonarQube)\n- name: Quality Gate\n  uses: sonarsource/sonarqube-quality-gate-action@master\n  env:\n    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n\n# Gate 2: Security/issue gate (this action)\n- name: Convert to SARIF\n  uses: vmvarela/sonarqube-ce-sarif-action@v1\n  with:\n    fail-on-severity: CRITICAL\n```\n\nThis separation allows you to enforce different quality criteria: project-wide metrics via SonarQube's gate, and PR-specific issue checks via this action.\n\n\u003c/details\u003e\n\n---\n\n## 🐛 Troubleshooting\n\n| Error | Solution |\n|-------|----------|\n| \"Permission denied\" | Add **Browse** permission to your SonarQube token |\n| \"Project not found\" | Verify `project-key` matches SonarQube exactly |\n| Timeout | Increase `max-wait-time` or use `processing-delay` |\n| No Check Run | Ensure `checks: write` permission in workflow |\n| No PR Comment | Ensure `pull-requests: write` permission |\n\n---\n\n## 📄 License\n\n[MIT](LICENSE) © vmvarela\n\n---\n\n\u003cp align=\"center\"\u003e\n  \u003cb\u003e⭐ Star this repo if you find it useful!\u003c/b\u003e\n\u003c/p\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmvarela%2Fsonarqube-ce-sarif-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvmvarela%2Fsonarqube-ce-sarif-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmvarela%2Fsonarqube-ce-sarif-action/lists"}