sonar-scanner

Wat het doet

Zo schrijf je het

sonar-scanner [-Dkey=value ...]

Belangrijkste delen

Key properties

sonar.projectKey

Unique project ID.

sonar.sources

Source folders.

sonar.tests

Test folders.

sonar.host.url

Server URL.

sonar.token

Analysis token (from env SONAR_TOKEN).

sonar.exclusions

Files to skip.

sonar.python.coverage.reportPaths / sonar.javascript.lcov.reportPaths

Coverage reports.

sonar.qualitygate.wait=true

Wait for the gate and fail the job if red.

Meest gebruikt

Niets past bij dit filter.

$ als gewone gebruiker# als root (of met sudo)

1. 1Run SonarQube for a lab

   $podman run -d --name sonarqube -p 9000:9000 docker.io/sonarqube:lts-community
   $curl -s http://localhost:9000/api/system/status

2. 2A project file

   $cat sonar-project.properties
   sonar.projectKey=s0sta_shop
   sonar.sources=app
   sonar.tests=tests
   sonar.exclusions=**/migrations/**
   sonar.python.coverage.reportPaths=coverage.xml

3. 3Run the scanner and wait for the gate

   $export SONAR_TOKEN=squ_exampletokenonly0000000000000000000000
   $sonar-scanner -Dsonar.host.url=http://localhost:9000 -Dsonar.qualitygate.wait=true

4. 4Run the scanner in a container

   $docker run --rm -e SONAR_HOST_URL=http://sonar.lab.local:9000 -e SONAR_TOKEN -v "$PWD:/usr/src" sonarsource/sonar-scanner-cli

5. 5Make a coverage report first (Python)

   $pytest --cov=app --cov-report=xml
   $sonar-scanner

6. 6GitHub Actions

   $cat .github/workflows/sonar.yml
         - uses: actions/checkout@v4
           with: { fetch-depth: 0 }
         - uses: SonarSource/sonarqube-scan-action@v4
           env:
             SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
             SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

7. 7Analyze a pull request (decoration)

   $sonar-scanner -Dsonar.pullrequest.key=42 -Dsonar.pullrequest.branch=feat/health -Dsonar.pullrequest.base=main

8. 8Read the gate status with the API

   $curl -s -u "$SONAR_TOKEN:" "http://localhost:9000/api/qualitygates/project_status?projectKey=s0sta_shop" | jq '.projectStatus.status'

9. 9List open vulnerabilities

   $curl -s -u "$SONAR_TOKEN:" "http://localhost:9000/api/issues/search?componentKeys=s0sta_shop&types=VULNERABILITY&resolved=false" | jq '.issues[].message'

10. 10Debug a failed analysis

    $sonar-scanner -X 2>&1 | tail -40

Niets past bij dit filter.

Bestanden

sonar-project.properties

Project settings.

Exitcodes