CLI-37 CLI-41 CLI-56 No auth secrets by kirill-knize-sonarsource · Pull Request #46 · SonarSource/sonarqube-cli

kirill-knize-sonarsource · 2026-02-26T12:47:45Z

No description provided.

src/commands/secret-scan.ts

src/commands/integrate.ts

src/commands/secret-scan.ts

sonarqubecloud · 2026-02-27T13:59:34Z

SonarQube reviewer guide

Summary: Enhance token repair flow, add non-interactive mode support, and make secrets authentication optional while improving code formatting and structure.

Review Focus:

runRepair() now returns the newly generated token instead of void—verify all callers handle the return value correctly
New nonInteractive parameter in runHealthCheckAndRepair() prevents browser-based token generation in CI environments when both ENV_TOKEN and ENV_SERVER are set
Secrets scanning no longer requires authentication; resolveSecretsAuth() gracefully handles missing credentials instead of failing
New "secrets-only mode" allows setup without a project key—ensure this path doesn't skip critical hooks installation
Code formatting changes are extensive; focus review on logic changes first

Start review at: src/commands/integrate.ts. This is the orchestration layer where the main flow logic resides. Focus on: (1) how nonInteractive is determined and passed down, (2) the new secrets-only mode path when !config.projectKey, (3) how the return value from runRepair() is now used, and (4) the updated error handling for missing tokens in non-interactive contexts.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
89.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vnaskos-sonar · 2026-02-27T14:09:30Z

src/commands/integrate.ts

-    warn(
-      `${missing} is not set. Both ${ENV_TOKEN} and ${ENV_SERVER} are required for environment variable authentication. Falling back to saved credentials.`,
-    );
+    warn(`${missing} is not set. Both ${ENV_TOKEN} and ${ENV_SERVER} are required for environment variable authentication. Falling back to saved credentials.`);


If I am on a directory where sonar-project.properties exist, the environment variables are skipped.

Which also means that in case I don't have a configured sonar auth then I am redirected to the SQC page to generate a token.

vnaskos-sonar · 2026-02-27T14:11:53Z

src/commands/integrate.ts

-    warn(
-      `${missing} is not set. Both ${ENV_TOKEN} and ${ENV_SERVER} are required for environment variable authentication. Falling back to saved credentials.`,
-    );
+    warn(`${missing} is not set. Both ${ENV_TOKEN} and ${ENV_SERVER} are required for environment variable authentication. Falling back to saved credentials.`);


on a dir without sonar-project.properties

without auth login

without ENV_SERVER

with ENV_TOKEN

It just continues to the Phase 1/3, skips the next to Phases and reports success. The warn message was never displayed.

vnaskos-sonar · 2026-02-27T14:15:28Z

src/commands/secret-scan.ts

-    process.exit(1);
+async function resolveSecretsAuth(): Promise<AuthConfig> {
+  // Env vars take priority — already set for CI or manual configuration
+  const envUrl = process.env[ENV_SECRETS_AUTH_URL];


I am a bit confused on which env variables should I use. I thought that ENV_SERVER value would be passed to the secrets cli. However, here we get the value of ENV_SECRETS_AUTH_URL. Are those two unrelated? 🤔

vnaskos-sonar · 2026-02-27T14:18:04Z

src/commands/secret-scan.ts

+    if (activeConnection) {
+      const token = await getToken(activeConnection.serverUrl, activeConnection.orgKey);
+      if (token) {
+        return { authUrl: activeConnection.serverUrl, authToken: token };


When running sonar analyze --file a-file-with-a-secret.yaml even without configured token (no auth login, no env variables), I always get the following output from the secrets cli

Sonar Secrets CLI - BETA (2.41.0.10709) Trying to authenticate to SonarQube Server or Cloud, in order to enable complete functionality Authentication successful

Not sure how it manages to authenticate successfully or if it's lying.

I noticed that secrets cli has a cache file for authentication .sonar-secrets-auth-cache. Not sure how sonar cli should handle that

vnaskos-sonar · 2026-02-27T14:21:14Z

src/bootstrap/repair.ts


    // Save to keychain
-    await saveToken(serverURL, token, organization);
+    await saveToken(serverURL, newToken, organization);


When running sonar integrate claude and I don't have sonar auth login,

the repair kicks in and SQC page pops up

I proceed to generate my token

the integrate command succeeds and the token is stored.

But (probably) the state is not updated, sonar auth status reports "No saved connection" and sonar auth purge shows the newly created connection.

Authentication is now optional for secrets scanning. The sonar-secrets binary has AUTH_ENABLED=false in production builds, so requiring CLI auth was unnecessary friction. Resolution priority: 1. SONAR_SECRETS_AUTH_URL + SONAR_SECRETS_TOKEN env vars (pass-through) 2. Active CLI connection + keychain token 3. No auth — binary runs without credentials � Conflicts: � src/commands/secret-scan.ts � tests/unit/secret-scan.test.ts

When no SonarQube server is configured, sonar integrate now installs secret scanning hooks without requiring a full SonarQube setup (secrets-only mode). This allows users to get secret scanning protection immediately, without needing a SonarQube account.

Pass --non-interactive flag to skip interactive auth prompt when running file scans (binary hangs on open stdin waiting for user input otherwise). Remove exit-code remap (1 -> 51): sonar-secrets v2.41 now returns 51 directly when secrets are found; exit 1 means a generic error.

kirill-knize-sonarsource force-pushed the feature/CLI-37-CLI-41-no-auth-secrets branch from 78461e7 to 2b826b0 Compare February 26, 2026 12:50

kirill-knize-sonarsource marked this pull request as draft February 26, 2026 13:00

kirill-knize-sonarsource changed the title ~~CLI-37 CLI-41 No auth secrets~~ CLI-37 CLI-41 CLI-56 No auth secrets Feb 26, 2026

kirill-knize-sonarsource marked this pull request as ready for review February 26, 2026 14:29

kirill-knize-sonarsource force-pushed the feature/CLI-37-CLI-41-no-auth-secrets branch 2 times, most recently from ee7d045 to 66c4104 Compare February 26, 2026 16:12

vnaskos-sonar reviewed Feb 26, 2026

View reviewed changes

src/commands/secret-scan.ts Outdated Show resolved Hide resolved

vnaskos-sonar reviewed Feb 26, 2026

View reviewed changes

src/commands/integrate.ts Outdated Show resolved Hide resolved

vnaskos-sonar reviewed Feb 26, 2026

View reviewed changes

src/commands/integrate.ts Outdated Show resolved Hide resolved

vnaskos-sonar reviewed Feb 26, 2026

View reviewed changes

src/commands/secret-scan.ts Show resolved Hide resolved

kirill-knize-sonarsource force-pushed the feature/CLI-37-CLI-41-no-auth-secrets branch from 0bb6f9c to 9133167 Compare February 27, 2026 12:29

kirill-knize-sonarsource requested a review from vnaskos-sonar February 27, 2026 12:30

kirill-knize-sonarsource force-pushed the feature/CLI-37-CLI-41-no-auth-secrets branch 3 times, most recently from 81ba918 to 5f1fb9d Compare February 27, 2026 13:55

vnaskos-sonar reviewed Feb 27, 2026

View reviewed changes

kirill-knize-sonarsource added 4 commits February 27, 2026 16:58

PR feedback

4a3a9e1

kirill-knize-sonarsource force-pushed the feature/CLI-37-CLI-41-no-auth-secrets branch from 5f1fb9d to 4a3a9e1 Compare February 27, 2026 16:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CLI-37 CLI-41 CLI-56 No auth secrets#46

CLI-37 CLI-41 CLI-56 No auth secrets#46
kirill-knize-sonarsource wants to merge 4 commits intomasterfrom
feature/CLI-37-CLI-41-no-auth-secrets

kirill-knize-sonarsource commented Feb 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 27, 2026

Uh oh!

vnaskos-sonar Feb 27, 2026

Uh oh!

vnaskos-sonar Feb 27, 2026

Uh oh!

vnaskos-sonar Feb 27, 2026

Uh oh!

vnaskos-sonar Feb 27, 2026

Uh oh!

vnaskos-sonar Feb 27, 2026

Uh oh!

vnaskos-sonar Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kirill-knize-sonarsource commented Feb 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 27, 2026

SonarQube reviewer guide

Quality Gate passed

Uh oh!

vnaskos-sonar Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

vnaskos-sonar Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

vnaskos-sonar Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

vnaskos-sonar Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

vnaskos-sonar Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

vnaskos-sonar Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants