title: How do I get Sonarcloud to run on pull requests from forks with Travis, Maven & github
body: <p>While looking into my recent question <a href="https://stackoverflow.com/q/45573102/42473">Sonarcloud failure with Travis, Maven &amp; github</a> I realised that I was asking the wrong question. I was trying to address a symptom rather than the underlying problem.</p>
  
  <p>A project I work on (<a href="https://github.com/eclipse/scanning" rel="noreferrer">eclipse/scanning</a>) uses Github as it's repository and Travis with Sonarcloud for continuous integration and code analysis.</p>
  
  <p>While the Sonarcloud analysis runs fine on internal pull requests (pull requests from branches pushed directly to eclipse/scanning) it doesn't work when Travis runs for external pull requests (those from forked repos).</p>
  
  <p>The underlying problem is that the way we are running sonarcloud at the moment relies on environment variables which aren't populated for external pull requests for security reasons:</p>
  
  <pre><code>Encrypted environment variables have been removed for security reasons.
  See https://docs.travis-ci.com/user/pull-requests/#Pull-Requests-and-Security-Restrictions
  </code></pre>
  
  <p>We have our repository set up to not care whether Sonarcloud is run, but that means that we often merge in changes which break sonarcloud rules because we don't realise they have been broken. We only see that those rules have been broken the <em>next time</em> they are changed by someone who does push directly to the repository. This moves the burden of fixing Sonarcloud discovered problems from collaborators to committers.</p>
  
  <p>So, </p>
  
  <ul>
  <li>Is there a way to enable Sonarcloud analysis of pull requests from forked repositories without introducing security issues?</li>
  </ul>
  
  <p><sub>Note that this question seems to be one step beyond <a href="https://stackoverflow.com/q/31209313/42473">In Travis Public Repository how to add a Secure variable that works on Pull requests too</a> which doesn't have an answer yet.</sub></p>