vmvarela/SonarQube to GitHub Security Tab (SARIF)
Export SonarQube issues to GitHub Security Tab via SARIF. Adds PR annotations and code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| sonar-host-url | SonarQube server URL (e.g., https://sonarqube.example.com) | yes | — |
| sonar-token | SonarQube authentication token with Browse permission | yes | — |
| project-key | SonarQube project key (defaults to repository name when omitted) | no | — |
| output-file | Output SARIF file path | no | sonarqube.sarif |
| branch | Branch to analyze (optional, defaults to main branch) | no | — |
| wait-for-processing | Wait for SonarQube analysis to complete before fetching issues | no | true |
| max-wait-time | Maximum time to wait for analysis completion (seconds) | no | 300 |
| polling-interval | Interval between status checks when waiting (seconds) | no | 10 |
| processing-delay | Fixed delay in seconds before fetching issues (0-600). Alternative to wait-for-processing when lacking Execute Analysis permission | no | 0 |
| min-severity | Minimum severity to include (INFO, MINOR, MAJOR, CRITICAL, BLOCKER) | no | INFO |
| include-resolved | Include resolved issues in output | no | false |
| pr-comment | Post a summary comment on pull requests when issues are found | no | true |
| fail-on-severity | Fail the check if issues at or above this severity exist (INFO, MINOR, MAJOR, CRITICAL, BLOCKER). Omit to never fail. | no | — |
| github-token | GitHub token for PR comments and check runs (defaults to github.token) | no | ${{ github.token }} |
| skip-preflight | Skip pre-flight validation checks (connectivity, token, project key). Use for offline/air-gapped setups. | no | false |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file |
| issues-count | Total number of issues converted |
| rules-count | Number of unique rules |
| components-count | Number of affected components/files |
| blocker-count | Number of BLOCKER severity issues |
| critical-count | Number of CRITICAL severity issues |
| major-count | Number of MAJOR severity issues |
| minor-count | Number of MINOR severity issues |
| info-count | Number of INFO severity issues |
| bugs-count | Number of BUG type issues |
| vulnerabilities-count | Number of VULNERABILITY type issues |
| code-smells-count | Number of CODE_SMELL type issues |
| hotspots-count | Number of SECURITY_HOTSPOT type issues |
| api-request-count | Total HTTP requests made to SonarQube API |
| api-error-count | Total failed requests (before retry) |
| api-retry-count | Total retry attempts across all requests |
| pages-fetched | Total pagination pages retrieved from SonarQube |
| rule-fetch-success-rate | Percentage of rule details successfully fetched (0-100) |
| sarif-file-size-bytes | Size of the generated SARIF file in bytes |
| processing-time-ms | Total action duration in milliseconds |