Sonar analysis doesn't work for PRs from forks

[nscuro]

Current Behavior

As identified in #1198, the Sonar analysis is currently broken for PRs originating from forks.

This is happening because the SONAR_TOKEN repository secret is not exposed to such PRs, causing an authentication failure with SonarCloud:

Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922:sonar (default-cli) on project hyades: Project not found. Please check the 'sonar.projectKey' and 'sonar.organization' properties, the 'SONAR_TOKEN' environment variable, or contact the project administrator

Steps to Reproduce

1. Fork this repository
2. Raise a PR
3. Observe the CI / Test workflow failing

Expected Behavior

The Sonar analysis should work for PRs originating from forks.

Note that we faced the same challenge when integrating Codacy into the dependency-track repository. The way we solved it there is:

• When building a PR, upload coverage files as build artifact
• Upon successful execution of the test workflow, trigger another workflow that downloads the coverage files and uploads them to Codacy (or Sonar in our case)

The reason this works is that the second workflow is executed within the context of the target repository, and as such has access to the required repository secret.

Hyades Version

n/a

Repository Type

Hyades services

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported