Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Code Analysis in CICD

Using Sonar Scanner:

Before analyzing the source code using [SonarScanner™](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/), make sure you have

  • Downloaded and installed [SonarScanner™](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/) CLI plugin. Refer to Installing Sonar Scanner

  • Follow the instructions here to generate security token

  • For on-premises instances, please use your organization-specific service URL instead of https://analyzer.integralzone.com

There are 2 ways in which the projects can be analyzed.

  • By creating and adding required properties in sonar-project.properties file in the parent directory of the project.

  • By directly passing all the properties as command line arguments

Steps outlined below uses the command line approach

  1. Go to the project root directory from command line/terminal

  2. Run sonar-scanner command with following options

    1. -Dsonar.projectKey=xxx Unique key for the project being uploaded

    2. -Dsonar.projectName=xxx Diplay name of the project being uploaded

    3. -Dsonar.projectVersion=x.x Version of the project being uploaded

    4. -Dsonar.sources=. Source code directory

    5. -Dsonar.login=xxx Security token generated from the server. This parameter is deprecated from SonarQube version > 10.x, use sonar.token instead

    6. -Dsonar.token=xxx Security token generated from the server. This parameter is applicable from SonarQube version > 10.x, for versions < 10.x use sonar.login parameter

    7. -Dsonar.organization=xxx + Optional. Applicable only for cloud version

    8. -Dsonar.branch.name=xxx + Optional. SCM branch for which code is being analysed. Eg: -Dsonar.branch.name=master

  3. Complete example may look like

    1. Using IZ Analyzer cloud instance PROJECT_ROOT_DIR> sonar-scanner -Dsonar.projectKey=xxx -Dsonar.organization= -Dsonar.sources=. -Dsonar.exclusions=target -Dsonar.host.url=https://analyzer.integralzone.com -Dsonar.login= \

    2. Using IZ Analyzer on-prem instance PROJECT_ROOT_DIR> sonar-scanner # -Dsonar.projectKey=xxx -Dsonar.projectName=xxx -Dsonar.sources=. -Dsonar.host.url= -Dsonar.login= \

  • For complete reference of all the properties that can be used with sonar-scanner, refer to Analysis Parameters

Using Maven Plugin

Before analyzing the source code using Maven Plugin, make sure you have:

  • Downloaded and installed Apache Maven. Refer to Installing Apache Maven

  • Follow the instructions here to generate security token

  1. Go to the project root directory from command line/terminal

  2. Run mvn sonar:sonar command with following options

    • -Dsonar.projectKey=xxx Unique key for the project being uploaded

    • -Dsonar.projectName=xxx Diplay name of the project being uploaded

    • -Dsonar.projectVersion=x.x Version of the project being uploaded

    • -Dsonar.sources=. Source code directory

    • -Dsonar.login=xxx Security token generated from the server. This parameter is deprecated from SonarQube version > 10.x, use sonar.token instead

    • -Dsonar.token=xxx Security token generated from the server. This parameter is applicable from SonarQube version > 10.x, for versions < 10.x use sonar.login parameter

    • -Dsonar.organization=xxx + Optional. Applicable only for cloud version

    • -Dsonar.branch.name=xxx + Optional. SCM branch for which code is being analysed. Eg: -Dsonar.branch.name=master

  3. Complete example may look like

    • Using IZ Analyzer cloud instance PROJECT_ROOT_DIR> mvn sonar:sonar -Dsonar.projectKey=xxx -Dsonar.organization= -Dsonar.exclusions=target -Dsonar.sources=. -Dsonar.host.url=https://analyzer.integralzone.com -Dsonar.login=

    • Using IZ Analyzer on-prem instance PROJECT_ROOT_DIR> mvn sonar:sonar -Dsonar.projectKey=xxx -Dsonar.projectName=xxx -Dsonar.sources=. -Dsonar.host.url= -Dsonar.login= \

Follow the instructions from Scanner for Maven for addition information about configuring the plugin

Setting Proxy Details

If the system from which the projects are analyzed using sonar-scanner or maven is configured with proxy, then set the following environment variable with proxy server details before running the respective commands

  • Windows > set SONAR_SCANNER_OPTS="-Dhttps.proxyHost=PROXY_HOST -Dhttps.proxyPort=PROXY_PORT -Dhttp.proxyHost=PROXY_HOST -Dhttp.proxyPort=PROXY_PORT -Djava.net.useSystemProxies=true"

  • Linux > export SONAR_SCANNER_OPTS="-Dhttps.proxyHost=PROXY_HOST -Dhttps.proxyPort=PROXY_PORT -Dhttp.proxyHost=PROXY_HOST -Dhttp.proxyPort=PROXY_PORT -Djava.net.useSystemProxies=true"

  • Replace PROXY_HOST and PROXY_PORT with appropriate values for Proxy server host and port

  • If https.proxyPort is not specified, default value will be 443

  • If http.proxyPort is not specified, default value will be 80

See Also

SonarQube™ is a trademark belonging to SonarSource SA. For further information, please visit www.sonarqube.org.

Last updated

Was this helpful?