SonarQube

SonarQube is the leading tool for continuous inspection of code quality. It detects bugs, vulnerabilities (SAST), and code smells in over 30 programming languages.

When to Use

• Continuous Code Quality & Clean Code Auditing: Analyzing codebases for bugs, vulnerabilities, security hotspots, and code smells.
• Quality Gates in Pull Requests: Enforcing that new code meets strict quality standards (test coverage, zero new bugs) before merging.
• Technical Debt & Maintainability Tracking: Measuring duplication percentage, complexity scores, and estimated remediation time.
• Enterprise Security Compliance: Ensuring codebases comply with security standards (OWASP Top 10, CWE, SANS Top 25).

Quick Start

docker run -d --name sonarqube -p 9000:9000 sonarqube:lts
# Login: admin/admin at http://localhost:9000

# sonar-project.properties
sonar.projectKey=my-project
sonar.sources=src
sonar.host.url=http://localhost:9000
sonar.login=...

Core Concepts

The "Clean as You Code" Methodology

Focuses quality gate enforcement on "New Code" (modified in the PR) rather than legacy debt:

[ Developer Branch ] ──Pull Request──→ [ CI Scanner ] ──Analyze New Code──→ [ Quality Gate PASS / FAIL ]

sonar-project.properties Configuration

Defines source paths, exclusions, test execution reports, and lcov coverage targets:

# sonar-project.properties
sonar.projectKey=enterprise-api-service
sonar.projectName=Enterprise API Service
sonar.sources=src
sonar.tests=tests
sonar.exclusions=**/node_modules/**,**/dist/**,**/*.spec.ts
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.qualitygate.wait=true

SonarScanner CLI Execution

Runs static analysis and uploads results to SonarQube Server or SonarCloud:

sonar-scanner \
  -Dsonar.host.url=https://sonarqube.internal.corp \
  -Dsonar.token=$SONAR_TOKEN

Common Patterns

Maven / Gradle Sonar Scanner Pipeline

Problem: Code smells and security hotspots merge to main branch unnoticed.

Solution: Run Sonar analysis during standard build jobs:

# Analyze with Maven passing project key and token
mvn clean verify sonar:sonar \
  -Dsonar.projectKey=my_enterprise_app \
  -Dsonar.host.url=https://sonarqube.internal.net \
  -Dsonar.token=$SONAR_TOKEN \
  -Dsonar.qualitygate.wait=true

Best Practices

Do:

• Enforce the Quality Gate on Pull Requests: Block merges if code coverage on new code is under 80% or if new security vulnerabilities are found.
• Upload Real Code Coverage Reports: Ensure unit test runs output valid LCOV or JaCoCo XML reports consumed by SonarQube.
• Review Security Hotspots Interactively: Investigate flagged security hotspots to confirm safe usage of cryptography and deserialization.
• Use SonarLint in IDEs: Run instant local analysis in VS Code/JetBrains to fix code smells before committing.

Don't:

• Attempt to fix all legacy technical debt at once: Adopt the Clean as You Code strategy; fix debt incrementally as files are modified.
• Disable rules to bypass failing Quality Gates: Address underlying architectural smells rather than weakening inspection rules.
• Run SonarScanner on untested code: Run tests and generate coverage reports before executing the Sonar scanner step.

Troubleshooting

References

• SonarQube Documentation
• Clean Code Principles