Installing CodeScan Self-Hosted
CodeScan On-Premises Implementation
What's New:
CodeScan Self-Hosted version 24.0.1 (now compatible with SonarQubeâĸ version 10.2 or earlier) is the latest CodeScan release. We strongly recommend all CodeScan users upgrade to this iteration.
Overview
This section describes installing the CodeScan self-hosted server, allowing you to experience a fully functional evaluation version of enterprise CodeScan on your server.
Prerequisite
Step 1: Request a CodeScan License Key
Note: If you already have a License Key or Subscription Code, proceed to step 2.
AutoRABIT Access/License Key: Before downloading the necessary files, email AutoRABITâs support team at support@codescan.io to request a CodeScan License Key.
Provide the following information in the email: âĸ Client Name (first and last â typically the admin) âĸ Client Company âĸ Email âĸ Duration of License (e.g., varies, 30 days)
Step 2: Download and Install SonarQubeâĸ & CodeScan Zip Files
SonarQubeâĸ Download
You must have a SonarQubeâĸ server currently running in your environment. If not, please visit SonarQube.org to download the latest Community version.
Note: This link will take you to the SonarQubeâĸ 9.9 LTS download. SonarQubeâĸ 10.0 is now supported as well.
CodeScan Zip File Download
Download the latest compatible CodeScan version (currently 24.0.1) from here.
Note: Keep in mind you need to download a version compatible with your SonarJS plugin version. Refer to the requirements section for more information.
You will need to enter your
License Key(to be provided by our Support Team) or aSubscription Code. For more information on Subscription Codes, click here.
Accept our Terms of Service and click on the
Request Downloadbutton.Extract the ZIP file. It contains the SonarQubeâĸ plugin and an ant-based tool enabling you to run an analysis.
Download links for supported or prior CodeScan versions:
| CodeScan Version | Platform Compatible | Date of Release | Support End Date | Download Link | Release Note |
|---|---|---|---|---|---|
24.0.1 (Current) | SonarQubeâĸ 10.2 or earlier | January 2024 | 30 January 2025 | ||
23.1.6 | SonarQubeâĸ 10.0 or earlier | 7 November 2023 | 30 June 2024 | ||
23.1.5 | SonarQubeâĸ 10.0 or earlier | 1 November 2023 | 30 June 2024 | ||
23.1.4 | SonarQubeâĸ 10.0 or earlier | 13 October 2023 | 30 June 2024 | ||
23.1.3 | SonarQubeâĸ 10.0 or earlier | 13 September 2023 | 30 June 2024 | ||
23.1.1 | SonarQubeâĸ 9.9 or earlier | 12 May 2023 | 30 June 2024 | ||
22.8 | SonarQubeâĸ 8.9+ and SonarQubeâĸ 9.9 | 25 December 2022 | 30 June 2024 | ||
22.7 | SonarQubeâĸ 8.9+ | 01 November 2022 | 30 June 2024 | ||
22.6.2 | SonarQubeâĸ 8.9+ | 12 July 2022 | 30 June 2024 | ||
22.6.1 | SonarQubeâĸ 8.9+ | 23 June 2022 | 30 June 2024 | ||
22.6 | SonarQubeâĸ 8.9+ | 13 June 2022 | 30 June 2024 | ||
22.5 | SonarQubeâĸ 8.9+ | 30 May 2022 | 30 June 2024 | ||
22.4 | SonarQubeâĸ 8.9+ | 16 May 2022 | 30 June 2024 |
Plugin Installation
Step 1: Download CodeScan file
Delete any existing Salesforce plugins from your installation.
Ensure your SonarJS plugin is compatible with the current CodeScan for Lightning version. Currently the supported release requires version 6.2+ of the SonarJS plugin. Click here to see alternatives.
Step 2: CodeScan JAR file
Copy CodeScan downloads JAR files,
sonar-salesforce-plugin-XXX.jarandsonar-codescanlang-plugin-XXX.jarinto your SonarQubeâĸ installation at /extensions/plugins/.Place JAR files into your SonarQubeâĸ file installation at /extensions/plugins/.
Keep the SonarQubeâĸ file open for the next steps.
Step 3: Start Web Server
Lastly, you need to RUNsonar to execute the script to start the server. In your SonarQubeâĸ installation file, open, '/bin' folder, choose server type, and select âStartSonarâ. Once rendering is finished, the plugin installation is complete.
Standard SonarQubeâĸ Setup
Step 2. Once you've gained access, go to Administrator > Configuration > General Settings.
Select the CodeScan tab.
Click Save.
You have successfully completed the CodeScan on-premise integration. See the instructions below on how to integrate this to ARM.
CodeScan On-Premises + ARM Integration
Overview
This guide will show you how to integrate the CodeScan self-hosted instance to ARM.
CodeScan On-Premises ARM Integration
Step 1: Generate a SonarQubeâĸ Token
Log in to your SonarQubeâĸ instance.
Go to User > My Account > Security. Your existing tokens are listed here, each with a Revoke button.
The form at the bottom of the page allows you to generate new tokens. Once you click the Generate button, you will see the token value. Be sure to copy it immediately; once you dismiss the notification, you will not be able to retrieve it.
This token is used when storing your credentials, such as your username and password, with AutoRABIT.
Step 2: Store Your SonarQubeâĸ Credentials in ARM
This initial step is when your SonarQubeâĸ credentials, such as your username and password, are stored in AutoRABIT.
Log in to your AutoRABIT account.
Hover your mouse over the Admin module and click on the Credentials tab.
Next, click on Create Credential from the right navigation bar.
On the next pop-up screen, enter the Credential Name.
Choose the Credential Type as Username with Password.
Choose your Credential Scope: Global: Credentials accessible within the team. Private: Credentials for private use.
Enter your SonarQubeâĸ account username. For password, use the copied token mentioned in Step 1.
Verify you are using your SonarQubeâĸ username instead of the email address you use to log in to SonarQubeâĸ.
Click Save.
Setting up Your Quality Profiles
In the SonarQubeâĸ self-hosted instance, click on the
Quality Profilesmenu.Make sure you have selected the
Salesforce Lightning profileas the default for both the JavaScript and Visualforce and Lightning languages. This can be done with the settings cog to the right of the profile name.
Running a Scan
There are a few ways to run your scan. The first is using our SFDX plugin (this requires that the Salesforce CLI and the SFDX CodeScan Plugin be installed).
Generate a token from the
My Account > Securitymenu in SonarQubeâĸ.Open the command prompt and navigate to:
Run the following command:
The Organization Key above will work for the Community edition of SonarQubeâĸ but may need to be edited depending on your setup using a paid edition.
You can also use Ant (this requires Ant version 1.9+).
Note: You will need to edit antbuild.properties if your SonarQubeâĸ installation is different than usual, or if you have a proxy. You can also edit /runner/antbuild.xml to customize your workflows.
Running SFDX plugin behind a proxy
To run the SFDX plugin behind a proxy, you will need to pass all the related information in the parameters of the analysis command.
Example:
where,
| Parameter | Description |
|---|---|
instanceurl | Enter your CodeScan instance url example- https://app.codescan.io for US region https://app-eu.codescan.io for EU region https://app-aus.codescan.io for AUS region. |
TKN | Enter your CodeScan security token (For more information on how to generate a security token, see Security Token) |
PRJ | Enter your CodeScan project key (to find your project key, refer to the article Project Key) |
ORG | Enter your CodeScan organization (for more information, see Create a new CodeScan Organization) |
SonarQubeâĸ ant plugin
For more instructions on setting up the SonarQubeâĸ ant plugin, see https://docs.sonarqube.org/latest/analysis/scan/sonarscanner-for-ant/. You should verify that the ant script's steps are appropriate for your requirements.
Create a copy of the
sonar-project-templatefolder in the runner directory of this folder and put it in the same project. Callit /runner/my-project. Add the following to thesonar-project.propertiesfile in themy-projectfolder.Set sonar.login= to a token available from the
My Account > Security menuin SonarQubeâĸ.Set sonar.projectKey=myproject
Set sonar.projectName=My Project
Set salesforce.username, salesforce.password and salesforce.url to your Salesforce username/password. Your Salesforce token must also be appended to the end of your salesforce.password parameter. For example:
salesforce.password=passwordtoken.Setting your Salesforce username, password, and URL is unnecessary if you want to analyze static content. Please use a system administrator user profile for this otherwise you may experience strange errors when downloading the code or executing tests.
Open a command prompt and navigate into
/runner/my-projectRun the following command:
Note: If the Anyone group is not granted Execute Analysis permission, or if the SonarQubeâĸ instance is secured (sonar.forceAuthentication property is set to true), a user whose credentials have Execute Analysis permission has to be provided through the sonar.login and sonar.password properties.
Proxies
If your network has a proxy, you must pass some more parameters to avoid license errors.
A guide for this is available HERE.
Having trouble?
Read the tutorials
Check the troubleshooting section
Contact Support
Last updated
![[CS Self-Hosted pic1.png] https://www.sonarsource.com/products/sonarqube/downloads/lts/9-9-lts/){target="_blank"}](https://knowledgebase.autorabit.com/~gitbook/image?url=https%3A%2F%2Fcdn.document360.io%2F8711f4e7-c040-4616-aac9-d947f87e4619%2FImages%2FDocumentation%2FCS%2520Self-Hosted%2520pic1%25281%2529.png&width=300&dpr=4&quality=100&sign=bcaed75752771fd977521be6b8496c02172f91f235e2af2d8600dc5da05cab82)
