Configuring GitHub project binding

Setting up GitHub integration features for your project in SonarQube Cloud.

Once your GitHub organization has been imported to SonarQube Cloud, you can create your SonarQube Cloud project by importing your GitHub repository. The so created SonarQube Cloud project is bound to its GitHub repository.

With a bound project, various analysis reporting features are supported on the DevOps platform. This page explains how to set them up.

Setting up pull request integration

For a bound project, the analysis results summary and issues are reported to your pull requests in GitHub provided:

• Your build script is configured to build on pull request creation and push.
• If you don't use an integrated CI tool, you must set up the pull request parameters manually, see Analysis parameters for more details.
• See Prerequisites for CI-based analysis for more details

Preventing the pull request merge if the quality gate fails

SonarQube Cloud adds the quality gate status as a GitHub check. To block pull requests from being merged if it is failing the quality gate, define on your branch a ruleset (recommended) or a protection rule.

With a branch ruleset

1. In GitHub, go to your repository Settings and select Rules > Rulesets under Code and automation.
2. Create a new branch ruleset (or edit an existing one).
3. In the Target branches section, select Add a target, and define the name pattern of the branches you want to target. For more information, see the GitHub documentation.
4. In the Branch rules section, select Require status checks to pass.
5. In the additional settings, select Require branches to be up to date before merging.
6. In Status checks that are required, select Add checks.
7. Find SonarCloud Code Analysis and add it to the list of required checks.

1. Finish creating the ruleset.

With a branch protection rule

1. In GitHub, go to your repository Settings > Branches > Branch protection rules and select either the Add rule or Edit button if you already have a rule on the branch you wish to protect.
2. Complete the Branch protection rule form:

   • Define the Branch name pattern (the name of the branch you wish to protect)
   • Select Require status checks to pass before merging to open supplementary form fields.
   • In the Search for status checks in the last week for this repository field, select Require branches to be up to date before merging, then find SonarCloud Code Analysis and add it to the list of required checks.
3. Finish creating the protection rule.

Disabling the inline annotations

By default, SonarQube Cloud reports issues on your pull requests as inline annotations. To disable the annotations:

1. Retrieve your project. See Retrieving projects for more details.
2. Go to Administration > General Settings > Pull Requests > Issue Annotations.
3. Unselect Enable Issue Annotations.

Disabling the analysis summary in the Conversation tab

By default, SonarQube Cloud shows the analysis summary in the Conversation and Checks tab of your GitHub pull requests.

To disable the summary in the Conversation tab:

1. Retrieve your project. See Retrieving projects for more details.
2. Go to Administration > General Settings > Pull Requests > Integration with GitHub.
3. Unselect Enable summary comment.

Pull request decoration is only supported on a bound project and requires that pull request integration be correctly configured for your project.

Reporting security issues in GitHub (GitHub code scanning alerts)

With the Enterprise plan, the report of the security issues inside the GitHub interface itself as code scanning alerts under the Security tab is supported for bound projects.

This feature is part of the GitHub Advanced Security package and is currently free for public projects. It is available as a paid option for private projects and GitHub Enterprise. This option is entirely on the GitHub side. Sonar does not charge anything extra to enable the code scanning alerts feature.

Issue status synchronization

When users change the status of a security issue in the SonarQube interface, the change is immediately reflected in the GitHub interface, and vice versa.

The table below shows the correspondence between SonarQube and GitHub on a status transition. Initially, all vulnerabilities marked Open on SonarQube Cloud are marked Open on GitHub.

On SonarQube Cloud, a transition to	results in this on GitHub
Accept	Won’t fix
False Positive	False positive
Confirm (Deprecated)	Open
Fixed (Deprecated)	Open
Reopen	Open

On GitHub, a transition to	results in this on SonarQube Cloud
False positive	False Positive
Used in tests	Accept
Won’t fix	Accept
Reopen	Open

Setting up the report of the security issues

The feature is only available to bound projects. No additional setup is required.

In GitHub, you can configure access to security alerts for your repository.

Related pages

• Binding an unbound project to a repository

• Getting started with GitHub

• Importing GitHub.com organization

• Creating your project

• Github Actions

• Setting your project's permissions

• Changing project binding

• Customizing Information page

• Deleting project

• In your DevOps platform

Related online learning

• Configuring code analysis for SonarQube Cloud with GitHub Actions
• Configuring pull request decoration for SonarQube Cloud with GitHub Actions