Cannot mint a GitHub installation token: project '{}' is not

Error message

Cannot mint a GitHub installation token: project '{}' is not bound to any DevOps Platform

What it means

GithubInstallationTokenProviderImpl.mint logs this warning and returns Optional.empty() when the project exists but has no project_alm_settings row, i.e. it is not bound to any DevOps Platform. The GitHub App installation flow requires a project-level binding to determine which repository and ALM setting to use. The empty result propagates to the caller of mint() as no token.

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/almsettings/github/GithubInstallationTokenProviderImpl.java:85

    this.githubGlobalSettingsValidator = githubGlobalSettingsValidator;
    this.githubApplicationClient = githubApplicationClient;
  }

  @Override
  public Optional<GithubInstallationToken> mint(String projectKey) {
    String safeProjectKey = sanitizeForLog(projectKey);
    AlmSettingDto resolvedAlmSetting;
    String resolvedAlmRepo;
    try (DbSession dbSession = dbClient.openSession(false)) {
      Optional<ProjectDto> project = dbClient.projectDao().selectProjectByKey(dbSession, projectKey);
      if (project.isEmpty()) {
        LOG.warn("Cannot mint a GitHub installation token: unknown project '{}'", safeProjectKey);
        return Optional.empty();
      }

      Optional<ProjectAlmSettingDto> projectAlmSetting = dbClient.projectAlmSettingDao().selectByProject(dbSession, project.get());
      if (projectAlmSetting.isEmpty()) {
        LOG.warn("Cannot mint a GitHub installation token: project '{}' is not bound to any DevOps Platform", safeProjectKey);
        return Optional.empty();
      }

      Optional<AlmSettingDto> almSetting = dbClient.almSettingDao().selectByUuid(dbSession, projectAlmSetting.get().getAlmSettingUuid());
      if (almSetting.isEmpty() || almSetting.get().getAlm() != ALM.GITHUB) {
        LOG.warn("Cannot mint a GitHub installation token: project '{}' is not bound to a GitHub App", safeProjectKey);
        return Optional.empty();
      }

      String almRepo = projectAlmSetting.get().getAlmRepo();
      if (almRepo == null || almRepo.isBlank()) {
        LOG.warn("Cannot mint a GitHub installation token: project '{}' has no repository configured on its DevOps Platform binding", safeProjectKey);
        return Optional.empty();
      }

      resolvedAlmSetting = almSetting.get();
      resolvedAlmRepo = almRepo;
    }

View on GitHub (pinned to 184c821202)

Solutions

Bind the project to GitHub: Project Settings > DevOps Platform Integration, or POST api/alm_settings/set_github with project, almSetting and repositoryName parameters.
Verify a GitHub ALM configuration exists globally (api/alm_integrations/create_github) before binding.
Check current binding with GET api/alm_settings/get_binding?project=<key>; if 404, bind then retry.
Add binding verification to provisioning scripts so new projects are always bound before token minting.

Example fix

// before
POST api/alm_integrations/install_github_app?projectKey=new-app -> empty (unbound)
// after
curl -u token: -X POST "$SQ_URL/api/alm_settings/set_github" \
  -d "project=new-app" -d "almSetting=github-company" -d "repositoryName=org/new-app"
POST api/alm_integrations/install_github_app?projectKey=new-app

Defensive patterns

Strategy: validation

Validate before calling

# Ensure the project is bound before minting
BINDING=$(curl -s -u "$TOKEN:" "$SQ_URL/api/alm_settings/get_binding?project=$KEY")
if echo "$BINDING" | grep -q 'does not exist\|not bound'; then
  curl -u "$TOKEN:" -X POST "$SQ_URL/api/alm_settings/set_github" -d "project=$KEY" -d "almSetting=$ALM" -d "repositoryName=$REPO"
fi

Prevention

Make set_github part of the standard project creation pipeline.
Alert on newly created projects that remain unbound after N days.
Check get_binding before any installation-token request.

When it happens

Trigger: Minting a GitHub installation token for a projectKey that exists in SonarQube but has never been bound to a DevOps Platform configuration (no api/alm_settings/set_github call made for it).

Common situations: Project created manually or via API without the DevOps integration setup step; binding deleted by an admin during cleanup; automation assumes binding exists because other projects in the org are bound.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/04ee3ce5c95049d8. Report an issue: GitHub.