PR feedback

Author: kirill-knize-sonarsource

src/bootstrap/repair.ts

@@ -35,8 +35,8 @@ export async function runRepair(
   healthResult: HealthCheckResult,
   _projectKey?: string,
   organization?: string,
-): Promise<void> {
-  let token = '';
+): Promise<string | undefined> {
+  let newToken: string | undefined;
 
   // Fix token if invalid
   if (!healthResult.tokenValid) {
@@ -50,21 +50,23 @@ export async function runRepair(
     }
 
     // Generate new token
-    token = await generateTokenViaBrowser(serverURL);
+    newToken = await generateTokenViaBrowser(serverURL);
 
     // Validate new token
-    const valid = await validateToken(serverURL, token);
+    const valid = await validateToken(serverURL, newToken);
     if (!valid) {
       throw new Error('Generated token is invalid');
     }
 
     // Save to keychain
-    await saveToken(serverURL, token, organization);
+    await saveToken(serverURL, newToken, organization);
     success('Token saved to keychain');
   }
 
   // Install sonar-secrets hooks for secret scanning
   text('Installing secret scanning hooks...');
   await installSecretScanningHooks(projectRoot);
   success('Secret scanning hooks installed');
+
+  return newToken;
 }

src/commands/integrate.ts

@@ -29,7 +29,7 @@ import { getAllCredentials } from '../lib/keychain.js';
 import { installSecretScanningHooks } from '../bootstrap/hooks.js';
 import { loadState, saveState, markAgentConfigured, addInstalledHook } from '../lib/state-manager.js';
 import { runCommand } from '../lib/run-command.js';
-import { version as VERSION } from '../../package.json';
+import { VERSION } from '../version.js';
 import logger from '../lib/logger.js';
 import { SONARCLOUD_URL, SONARCLOUD_HOSTNAME } from '../lib/config-constants.js';
 import { ENV_TOKEN, ENV_SERVER } from '../lib/auth-resolver.js';
@@ -255,6 +255,7 @@ async function runHealthCheckAndRepair(
   token: string | undefined,
   organization: string | undefined,
   skipHooks: boolean | undefined,
+  nonInteractive?: boolean,
 ): Promise<string | undefined> {
   text('\nPhase 2/3: Health Check & Repair');
   blank();
@@ -279,18 +280,26 @@ async function runHealthCheckAndRepair(
     text(`  - ${msg}`);
   }
 
+  if (nonInteractive && !healthResult.tokenValid) {
+    // Can't repair token without browser interaction — install hooks and continue
+    if (!skipHooks) {
+      await installSecretScanningHooks(projectInfo.root);
+    }
+    return token;
+  }
+
   // Repair (part of Phase 2)
   text('\n  Running repair...');
 
-  await runRepair(
+  const repairedToken = await runRepair(
     serverURL,
     projectInfo.root,
     healthResult,
     projectKey,
     organization,
   );
 
-  return token;
+  return repairedToken ?? token;
 }
 
 /**
@@ -403,6 +412,8 @@ export async function integrateCommand(agent: string, options: OnboardAgentOptio
   if (!config.projectKey) {
     text('\nNo project key configured.');
     text('Installing secret scanning hooks only.');
+    text('\nPhase 2/3: Health Check & Repair — skipped (no project key)');
+    text('Phase 3/3: Final Verification — skipped (no project key)');
     if (!options.skipHooks) {
       await installSecretScanningHooks(projectInfo.root);
       await updateStateAfterConfiguration(true);
@@ -417,6 +428,11 @@ export async function integrateCommand(agent: string, options: OnboardAgentOptio
   // Ensure token is available
   let token = await ensureToken(config.token, serverURL, config.organization);
 
+  // When both env vars are set the caller is in a CI/automated context — treat as
+  // non-interactive so that a bad token never triggers browser-based repair.
+  const envBasedAuth = !!(process.env[ENV_TOKEN] && process.env[ENV_SERVER]);
+  const effectiveNonInteractive = options.nonInteractive || envBasedAuth;
+
   // Phase 2 & 3: Health Check and Repair
   if (token) {
     token = await runHealthCheckAndRepair(
@@ -426,6 +442,7 @@ export async function integrateCommand(agent: string, options: OnboardAgentOptio
       token,
       config.organization,
       options.skipHooks,
+      effectiveNonInteractive,
     );
 
     if (token) {
@@ -445,6 +462,16 @@ export async function integrateCommand(agent: string, options: OnboardAgentOptio
 
   // If no token, run repair to generate one
   if (!token) {
+    if (effectiveNonInteractive) {
+      // Can't generate token without browser — install hooks only
+      if (!options.skipHooks) {
+        await installSecretScanningHooks(projectInfo.root);
+      }
+      await updateStateAfterConfiguration(!options.skipHooks);
+      outro('Setup complete!', 'success');
+      return;
+    }
+
     token = await runRepairWithoutToken(
       serverURL,
       projectKey,

src/commands/secret-scan.ts

@@ -325,7 +325,7 @@ function handleScanFailure(
   exitCode: number
 ): void {
   blank();
-  error('Scan failed');
+  error('Scan found secrets');
   logger.error(`Scan failed with exit code: ${exitCode}`);
   text(`  Exit code: ${exitCode}`);
   text(`  Duration: ${scanDurationMs}ms`);

src/version.ts

@@ -0,0 +1,22 @@
+/*
+ * SonarQube CLI
+ * Copyright (C) 2026 SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+// Auto-generated from package.json — do not edit manually
+export const VERSION = '0.4.2';

tests/unit/secret-scan.test.ts

@@ -251,7 +251,7 @@ describe('secretCheckCommand: scan failures', () => {
 
     expect(mockExit).toHaveBeenCalledWith(51);
     const errors = getMockUiCalls().filter(c => c.method === 'error').map(c => String(c.args[0]));
-    expect(errors.some(m => m.includes('Scan failed'))).toBe(true);
+    expect(errors.some(m => m.includes('Scan found secrets'))).toBe(true);
   });
 
   it('exits 1 when binary exits 1 (error, not secrets found)', async () => {