🛡️ SonarQube CE → GitHub Security Tab

Bridge the gap between SonarQube CE and GitHub. This GitHub Action brings PR decoration, inline annotations, and Security Tab integration to SonarQube Community Edition users.

✨ What You Get

❌ Without This Action

Issues buried in SonarQube dashboard
No PR feedback
No GitHub Security integration
Manual context switching

✅ With This Action

Inline annotations on your PR
Check Run summary with issue counts
Issues in GitHub Security Tab
PR comments with analysis results

📊 Feature Comparison

Feature	SonarQube CE	Developer+ Editions	CE + This Action
Code Analysis	✅	✅	✅
PR Decoration	❌	✅	✅
GitHub Security Tab	—	—	✅
Inline Annotations	❌	✅	✅
Check Run Summary	❌	✅	✅

🚀 Quick Start (Copy & Paste)

name: SonarQube Analysis

on:
  push:
    branches: [main]
  pull_request:

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      checks: write
      pull-requests: write
      
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Your SonarQube scan (use your preferred method)
      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@v4
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      # Convert to SARIF and get all the features ✨
      - name: SonarQube → GitHub Security
        uses: vmvarela/sonarqube-ce-sarif-action@v1
        with:
          sonar-host-url: ${{ secrets.SONAR_HOST_URL }}
          sonar-token: ${{ secrets.SONAR_TOKEN }}

      # Upload to GitHub Security Tab (only on push to default branch)
      - name: Upload SARIF
        if: github.event_name != 'pull_request'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sonarqube.sarif

That's it! Your PRs get inline annotations and check summaries; the Security Tab reflects the state of your default branch.

🎯 Features

📝 Check Run with Annotations

Every PR gets a Check Run with:

Summary table (issues by severity/type)
Up to 50 inline code annotations
Direct link to Security Tab

💬 PR Comments

When issues are found, a summary comment is posted:

Issue counts by severity
Link to Security Tab (filtered by PR)
Auto-updates (no duplicate comments)

🔍 Smart PR Filtering

In PR context, only shows issues from files you changed - not the entire project.

🚫 Quality Gates

Optionally fail the check on specific severities:

- uses: vmvarela/sonarqube-ce-sarif-action@v1
  with:
    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}
    sonar-token: ${{ secrets.SONAR_TOKEN }}
    fail-on-severity: CRITICAL  # Fails if CRITICAL or BLOCKER issues exist

⚙️ Configuration

Required Inputs

Input	Description
`sonar-host-url`	Your SonarQube server URL
`sonar-token`	Token with Browse permission

Optional Inputs

Input	Default	Description
`project-key`	Repo name	SonarQube project key
`output-file`	`sonarqube.sarif`	Output file path
`min-severity`	`INFO`	Filter: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER`
`fail-on-severity`	-	Fail check at this severity
`pr-comment`	`true`*	Post PR comment when issues found
`wait-for-processing`	`true`	Wait for SonarQube analysis to complete
`processing-delay`	`0`	Fixed delay (seconds) as alternative to waiting

* PR comments only appear in pull request context and when issues are found.

Outputs

Output	Description
`sarif-file`	Generated SARIF file path
`issues-count`	Total issues
`bugs-count`	Bug count
`vulnerabilities-count`	Vulnerability count
`code-smells-count`	Code smell count

📋 All Outputs

Output	Description
`sarif-file`	Path to the generated SARIF file
`issues-count`	Total number of issues converted
`rules-count`	Number of unique rules
`components-count`	Number of affected files
`blocker-count`	BLOCKER severity issues
`critical-count`	CRITICAL severity issues
`major-count`	MAJOR severity issues
`minor-count`	MINOR severity issues
`info-count`	INFO severity issues
`bugs-count`	BUG type issues
`vulnerabilities-count`	VULNERABILITY type issues
`code-smells-count`	CODE_SMELL type issues
`hotspots-count`	SECURITY_HOTSPOT type issues

🔐 Permissions

SonarQube Token

Permission	Required For
Browse	✅ Required - fetching issues
Execute Analysis	Optional - for `wait-for-processing`

GitHub Token

The action uses GITHUB_TOKEN automatically. Add these permissions:

permissions:
  security-events: write  # Upload SARIF
  checks: write           # Create Check Run
  pull-requests: write    # Post PR comments

🔧 Advanced Usage

Why Skip SARIF Upload on PRs?

SonarQube CE doesn't support true PR analysis—it always analyzes the main branch. In PR context, this action filters issues to changed files, but cannot distinguish new issues from pre-existing ones.

Uploading SARIF on PRs can cause:

False positives: Historical issues appearing as "new" in your PR
Inconsistent state: Issues "fixed" in PR reappearing after merge
Noise: Security Tab should reflect the default branch, not partial changes

Recommended approach: Use Check Run annotations and PR comments for PR feedback; upload SARIF only on push/schedule to the default branch (as shown in Quick Start).

Filter by Severity

Only include MAJOR and above:

- uses: vmvarela/sonarqube-ce-sarif-action@v1
  with:
    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}
    sonar-token: ${{ secrets.SONAR_TOKEN }}
    min-severity: MAJOR

Without Execute Analysis Permission

If your token only has Browse permission:

- uses: vmvarela/sonarqube-ce-sarif-action@v1
  with:
    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}
    sonar-token: ${{ secrets.SONAR_TOKEN }}
    wait-for-processing: false
    processing-delay: 60  # Wait 60s for analysis

Disable PR Comments

- uses: vmvarela/sonarqube-ce-sarif-action@v1
  with:
    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}
    sonar-token: ${{ secrets.SONAR_TOKEN }}
    pr-comment: false

Use Outputs in Workflow

- name: Convert to SARIF
  id: sarif
  uses: vmvarela/sonarqube-ce-sarif-action@v1
  with:
    sonar-host-url: ${{ secrets.SONAR_HOST_URL }}
    sonar-token: ${{ secrets.SONAR_TOKEN }}

- name: Check Results
  run: |
    echo "Found ${{ steps.sarif.outputs.issues-count }} issues"
    echo "Vulnerabilities: ${{ steps.sarif.outputs.vulnerabilities-count }}"

❓ FAQ

Why don't I see issues from my branch?

SonarQube CE doesn't support branch analysis. The action fetches all project issues and filters them to files changed in your PR. For branch-specific analysis, you need SonarQube Developer Edition.

How does severity mapping work?

SonarQube	SARIF Level	GitHub Display
BLOCKER	error	🔴 Critical
CRITICAL	error	🔴 High
MAJOR	warning	🟠 Medium
MINOR	note	🟡 Low
INFO	note	⚪ Info

What if my token lacks Execute Analysis permission?

Use processing-delay instead of wait-for-processing:

wait-for-processing: false
processing-delay: 60  # seconds

Do resolved issues disappear from GitHub?

Yes! When issues are fixed and no longer in the SARIF file, GitHub automatically marks them as Fixed in the Security tab.

What's the relationship with SonarQube Quality Gates?

This action does not consult SonarQube's Quality Gate. They operate independently:

Feature	SonarQube Quality Gate	This Action (`fail-on-severity`)
Evaluates	Project metrics (coverage, duplications, ratings)	Issue count by severity
Defined in	SonarQube UI/config	Workflow YAML
Fails when	Metrics don't meet thresholds (e.g., coverage < 80%)	Issues exist at/above specified severity
Scope	Entire project	Issues (filtered to PR files if applicable)

Using both together:

# Gate 1: Project health (SonarQube)
- name: Quality Gate
  uses: sonarsource/sonarqube-quality-gate-action@master
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

# Gate 2: Security/issue gate (this action)
- name: Convert to SARIF
  uses: vmvarela/sonarqube-ce-sarif-action@v1
  with:
    fail-on-severity: CRITICAL

This separation allows you to enforce different quality criteria: project-wide metrics via SonarQube's gate, and PR-specific issue checks via this action.

🐛 Troubleshooting

Error	Solution
"Permission denied"	Add Browse permission to your SonarQube token
"Project not found"	Verify `project-key` matches SonarQube exactly
Timeout	Increase `max-wait-time` or use `processing-delay`
No Check Run	Ensure `checks: write` permission in workflow
No PR Comment	Ensure `pull-requests: write` permission

📄 License

MIT © vmvarela

⭐ Star this repo if you find it useful!

Name		Name	Last commit message	Last commit date
Latest commit History 22 Commits
.github		.github
.husky		.husky
dist		dist
docs		docs
src		src
tests		tests
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
action.yml		action.yml
eslint.config.js		eslint.config.js
package-lock.json		package-lock.json
package.json		package.json
sonar-project.properties		sonar-project.properties
tsconfig.json		tsconfig.json
vitest.config.ts		vitest.config.ts

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Repository files navigation

🛡️ SonarQube CE → GitHub Security Tab

✨ What You Get

❌ Without This Action

✅ With This Action

📊 Feature Comparison

🚀 Quick Start (Copy & Paste)

🎯 Features

📝 Check Run with Annotations

💬 PR Comments

🔍 Smart PR Filtering

🚫 Quality Gates

⚙️ Configuration

Required Inputs

Optional Inputs

Outputs

🔐 Permissions

SonarQube Token

GitHub Token

🔧 Advanced Usage

Why Skip SARIF Upload on PRs?

Filter by Severity

Without Execute Analysis Permission

Disable PR Comments

Use Outputs in Workflow

❓ FAQ

🐛 Troubleshooting

📄 License

About

Uh oh!

Releases 4

Packages

Contributors 4

Uh oh!

Languages

License

vmvarela/sonarqube-ce-sarif-action

Folders and files

Latest commit

History

Repository files navigation

🛡️ SonarQube CE → GitHub Security Tab

✨ What You Get

❌ Without This Action

✅ With This Action

📊 Feature Comparison

🚀 Quick Start (Copy & Paste)

🎯 Features

📝 Check Run with Annotations

💬 PR Comments

🔍 Smart PR Filtering

🚫 Quality Gates

⚙️ Configuration

Required Inputs

Optional Inputs

Outputs

🔐 Permissions

SonarQube Token

GitHub Token

🔧 Advanced Usage

Why Skip SARIF Upload on PRs?

Filter by Severity

Without Execute Analysis Permission

Disable PR Comments

Use Outputs in Workflow

❓ FAQ

🐛 Troubleshooting

📄 License

About

Resources

License

Security policy

Uh oh!

Stars

Watchers

Forks

Releases 4

Packages 0

Contributors 4

Uh oh!

Languages

Packages