SonarSource/sonarqube · warning

Cannot mint a GitHub installation token: project '{}' is not

Error message

Cannot mint a GitHub installation token: project '{}' is not bound to a GitHub App

What it means

GithubInstallationTokenProviderImpl.mint logs this warning and returns Optional.empty() when the project's DevOps Platform binding is not a GitHub App binding — either the ALM setting was deleted (empty Optional from almSettingDao.selectByUuid) or its alm type is not ALM.GITHUB. Minting a GitHub App installation token only works for projects bound via a GitHub App configuration; GitLab/Bitbucket/Azure bindings cannot yield one.

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/almsettings/github/GithubInstallationTokenProviderImpl.java:91

    String safeProjectKey = sanitizeForLog(projectKey);
    AlmSettingDto resolvedAlmSetting;
    String resolvedAlmRepo;
    try (DbSession dbSession = dbClient.openSession(false)) {
      Optional<ProjectDto> project = dbClient.projectDao().selectProjectByKey(dbSession, projectKey);
      if (project.isEmpty()) {
        LOG.warn("Cannot mint a GitHub installation token: unknown project '{}'", safeProjectKey);
        return Optional.empty();
      }

      Optional<ProjectAlmSettingDto> projectAlmSetting = dbClient.projectAlmSettingDao().selectByProject(dbSession, project.get());
      if (projectAlmSetting.isEmpty()) {
        LOG.warn("Cannot mint a GitHub installation token: project '{}' is not bound to any DevOps Platform", safeProjectKey);
        return Optional.empty();
      }

      Optional<AlmSettingDto> almSetting = dbClient.almSettingDao().selectByUuid(dbSession, projectAlmSetting.get().getAlmSettingUuid());
      if (almSetting.isEmpty() || almSetting.get().getAlm() != ALM.GITHUB) {
        LOG.warn("Cannot mint a GitHub installation token: project '{}' is not bound to a GitHub App", safeProjectKey);
        return Optional.empty();
      }

      String almRepo = projectAlmSetting.get().getAlmRepo();
      if (almRepo == null || almRepo.isBlank()) {
        LOG.warn("Cannot mint a GitHub installation token: project '{}' has no repository configured on its DevOps Platform binding", safeProjectKey);
        return Optional.empty();
      }

      resolvedAlmSetting = almSetting.get();
      resolvedAlmRepo = almRepo;
    }

    // GitHub App calls below are network I/O, deliberately made outside the DbSession above: the
    // orchestrator mints a fresh token before every git operation (no caching, by design), so
    // holding a pooled DB connection for their duration would add unnecessary contention under load.
    return mint(projectKey, resolvedAlmSetting, resolvedAlmRepo);
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Re-bind the project to a GitHub App ALM configuration: POST api/alm_settings/set_github with the correct almSetting key.
2. Recreate the missing GitHub ALM configuration at global level (api/alm_integrations/create_github) if it was deleted.
3. Remove the stale non-GitHub binding first (api/alm_settings/remove_binding) if it conflicts, then bind to GitHub.
4. In tooling, check GET api/alm_settings/get_binding and confirm alm is 'github' before requesting installation tokens.

Example fix

// before: binding almSetting points to GitLab config 'gitlab-company'
// after
curl -u token: -X POST "$SQ_URL/api/alm_settings/set_github" \
  -d "project=my-app" -d "almSetting=github-company" -d "repositoryName=org/my-app"

# Confirm the binding is a GitHub App binding before minting
ALM=$(curl -s -u "$TOKEN:" "$SQ_URL/api/alm_settings/get_binding?project=$KEY" | jq -r '.alm // empty')
[ "$ALM" = "github" ] || { echo "Project bound to $ALM, not GitHub App" >&2; exit 1; }

When it happens

Trigger: Minting a GitHub installation token for a project whose projectAlmSetting points to an almSettingUuid of a non-GitHub ALM (e.g. GitLab) or to a deleted ALM configuration.

Common situations: Organization migrated the project from GitLab/Azure to GitHub but left the old binding; global GitHub ALM setting deleted while project bindings remained; admin picked the wrong ALM configuration when binding the project.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Cannot mint a GitHub installation token for project '{}': Gi
• Missing permissions; permission granted on %s
• Missing Client Secret
• '%s' must be a member of at least one organization which has
• Cannot mint a GitHub installation token for project '%s': in

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/5641d9bd518048b6. Report an issue: GitHub.