Installing CodeScan Self-Hosted
Last updated
Was this helpful?
Last updated
Was this helpful?
What's New:
CodeScan Self-Hosted now has two versions available to meet your operating system needs:
CodeScan version 25.1.0 Eagle Edition v3.0 (now compatible with SonarQube™ versions 10.1 to 2025.1 LTA) is the latest CodeScan release. We strongly recommend all CodeScan users upgrade to this iteration.
CodeScan version 25.0.1 Tiger Edition v3.0 (now compatible with SonarQube™ version 9.9 LTA and 10.0 to 10.3) is a newer version of the CodeScan release for users running older versions of SonarQube™.
This section describes installing the CodeScan self-hosted server, allowing you to experience a fully functional evaluation version of enterprise CodeScan on your server.
AutoRABIT Access/License Key: Before downloading the necessary files, email AutoRABIT’s support team at to request a CodeScan License Key.
Provide the following information in the email: • Client Name (first and last – typically the admin) • Client Company • Email • Duration of License (e.g., varies, 30 days)
The following matrix identifies the current versions of SonarQube™ supported for CodeScan Self-Hosted clients:
Check your SonarQube compatibility in the matrices below based on your CodeScan version.
Find the latest compatible CodeScan version and download it from the chart below. Release notes are also provided for your convenience.
Extract the ZIP file. It contains the SonarQube™ plugin and an ant-based tool enabling you to run an analysis.
Delete any existing Salesforce plugins from your installation.
Copy CodeScan downloads JAR files, sonar-salesforce-plugin-XXX.jar and sonar-codescanlang-plugin-XXX.jar into your SonarQube™ installation at /extensions/plugins/.
Place JAR files into your SonarQube™ file installation at /extensions/plugins/.
Keep the SonarQube™ file open for the next steps.
Lastly, you need to RUNsonar to execute the script to start the server. In your SonarQube™ installation file, open, '/bin' folder, choose server type, and select ‘StartSonar’. Once rendering is finished, the plugin installation is complete.
Step 2. Once you've gained access, go to Administrator > Configuration > General Settings.
Select the CodeScan tab.
Enter your CodeScan License Key in the designated field.
Click Save.
You have successfully completed the CodeScan self-hosted integration. See the instructions below on how to integrate this to ARM.
This guide will show you how to integrate the CodeScan self-hosted instance with ARM.
Step 1: Generate a SonarQube™ Token
Log in to your SonarQube™ instance.
Go to User > My Account > Security. Your existing tokens are listed here, each with a Revoke button.
The form at the bottom of the page allows you to generate new tokens. Once you click the Generate button, you will see the token value. Be sure to copy it immediately; once you dismiss the notification, you will not be able to retrieve it.
This token is used when storing your credentials, such as your username and password, with AutoRABIT.
Step 2: Store Your SonarQube™ Credentials in ARM
This initial step is when your SonarQube™ credentials, such as your username and password, are stored in AutoRABIT.
Log in to your AutoRABIT account.
Hover your mouse over the Admin module and click on the Credentials tab.
Next, click on Create Credential from the right navigation bar.
On the next pop-up screen, enter the Credential Name.
Choose the Credential Type as Username with Password.
Choose your Credential Scope: Global: Credentials accessible within the team. Private: Credentials for private use.
Enter your SonarQube™ account username. For password, use the copied token mentioned in Step 1.
Verify you are using your SonarQube™ username instead of the email address you use to log in to SonarQube™.
Click Save.
In the SonarQube™ self-hosted instance, click on the Quality Profiles menu.
Make sure you have selected the Salesforce Lightning profile as the default for both the JavaScript and Visualforce and Lightning languages. This can be done with the settings cog to the right of the profile name.
Generate a token from the My Account > Security menu in SonarQube™.
Open the command prompt and navigate to:
Run the following command:
You can also use Ant (this requires Ant version 1.9+).
To run the SFDX plugin behind a proxy, you will need to pass all the related information in the parameters of the analysis command.
Example:
where,
instanceurl
TKN
PRJ
ORG
Create a copy of the sonar-project-template folder in the runner directory of this folder and put it in the same project. Call it /runner/my-project. Add the following to the sonar-project.properties file in the my-project folder.
Set sonar.login= to a token available from the My Account > Security menu in SonarQube™.
Set sonar.projectKey=myproject
Set sonar.projectName=My Project
Set salesforce.username, salesforce.password and salesforce.url to your Salesforce username/password. Your Salesforce token must also be appended to the end of your salesforce.password parameter.
For example: salesforce.password=passwordtoken.
Setting your Salesforce username, password, and URL is unnecessary if you want to analyze static content. Please use a system administrator user profile for this otherwise you may experience strange errors when downloading the code or executing tests.
Open a command prompt and navigate into /runner/my-project
Run the following command:
If your network has a proxy, you must pass some more parameters to avoid license errors.
Read the tutorials
Check the troubleshooting section
You must have a SonarQube™ server currently running in your environment. If not, please visit to download the latest Community version.
At , find the latest compatible version with the CodeScan version you are using.
Note: This will take you to the SonarQube™ 9.9 LTA download.
Note: Keep in mind you need to download a version compatible with your SonarJS plugin version. Refer to the section for more information.
You will need to enter your License Key (to be provided by our Support Team) or a Subscription Code. For more information on Subscription Codes, click .
Accept our and click on the Request Download button.
Ensure your SonarJS plugin is compatible with the current CodeScan for Lightning version. Currently the supported release requires version 6.2+ of the SonarJS plugin. Click to see alternatives.
Step 1: Log in to the SonarQube™ self-hosted instance at . The default System Admin credentials are admin/admin:
There are a few ways to run your scan. The first is using our SFDX plugin (this requires that the and the be installed).
The above will work for the Community edition of SonarQube™ but may need to be edited depending on your setup using a paid edition.
Enter your CodeScan instance url example- for US region for EU region for AUS region.
Enter your CodeScan security token (For more information on how to generate a security token, see )
Enter your CodeScan project key (to find your project key, refer to this article: )
Enter your CodeScan organization (for more information, see )
For more instructions on setting up the SonarQube™ ant plugin, see . You should verify that the ant script's steps are appropriate for your requirements.
A guide for this is available .
Contact .
