From d8d5bcd3f968a0f083b54348988eb03711bf9a5d Mon Sep 17 00:00:00 2001 From: "antoine.vinot" Date: Wed, 29 Apr 2026 11:00:02 +0200 Subject: [PATCH] Update README.md --- README.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/README.md b/README.md index 98b8903..3102bc8 100644 --- a/README.md +++ b/README.md @@ -200,6 +200,23 @@ This can be useful when the runner executing the action is self-hosted and has r scannerBinariesUrl: https://my.custom.binaries.url.com/Distribution/sonar-scanner-cli/ ``` +#### `skipSignatureVerification` + +By default, the action verifies the OpenPGP signature of the SonarScanner CLI binary before executing it. You can disable this verification using the `skipSignatureVerification` option: + +```yaml +- uses: SonarSource/sonarqube-scan-action@ + with: + skipSignatureVerification: true +``` + +> [!NOTE] +> Signature verification requires `dirmngr` to be installed on the runner. GitHub-hosted runners include it, but some self-hosted runners or containers may not. +> +> **Version history:** +> - Introduced in **v7.2** with a default value of `true` to avoid breaking existing workflows on runners without `dirmngr`. +> - Changed to `false` by default in **v8** (breaking change). If your runner does not have `dirmngr` installed, set this option to `true` explicitly. + More information about possible analysis parameters can be found: * in the [Analysis parameters page](https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/analysis-parameters/) of the SonarQube Server documentation * in the [Analysis parameters page](https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/analysis-parameters/) of the SonarQube Cloud documentation