> For the complete documentation index, see [llms.txt](https://knowledgebase.autorabit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.autorabit.com/product-guides/integral-zone/iz-analyzer/source-code-analysis/code-analysis-in-cicd.md). # Code Analysis in CICD ### Using Sonar Scanner: {% hint style="info" %} Before analyzing the source code using **`[SonarScanner™](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/)`**, make sure you have * Downloaded and installed **`[SonarScanner™](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/)`** CLI plugin. Refer to [Installing Sonar Scanner](/product-guides/integral-zone/iz-suite/iz-scan/anypoint-studio/installation/install-iz-analyzer-studio.md) * Follow the instructions [here](/product-guides/integral-zone/iz-suite/iz-scan/anypoint-studio/installation/install-iz-analyzer-studio.md) to generate security token * For on-premises instances, please use your organization-specific service URL instead of [https://analyzer.integralzone.com](https://analyzer.integralzone.com/) {% endhint %} There are 2 ways in which the projects can be analyzed. * By creating and adding required properties in sonar-project.properties file in the parent directory of the project. * By directly passing all the properties as command line arguments Steps outlined below uses the command line approach 1. Go to the project root directory from command line/terminal 2. Run **`sonar-scanner`** command with following options 1. -Dsonar.projectKey=xxx\ \&#xNAN;*Unique key for the project being uploaded* 2. -Dsonar.projectName=xxx\ \&#xNAN;*Diplay name of the project being uploaded* 3. -Dsonar.projectVersion=x.x\ \&#xNAN;*Version of the project being uploaded* 4. -Dsonar.sources=.\ \&#xNAN;*Source code directory* 5. -Dsonar.login=xxx\ \&#xNAN;*Security token generated from the server. This parameter is deprecated from SonarQube version > 10.x, use sonar.token instead* 6. -Dsonar.token=xxx\ \&#xNAN;*Security token generated from the server. This parameter is applicable from SonarQube version > 10.x, for versions < 10.x use sonar.login parameter* 7. -Dsonar.organization=xxx + *Optional. Applicable only for cloud version* 8. -Dsonar.branch.name=xxx + *Optional. SCM branch for which code is being analysed. Eg: -Dsonar.branch.name=master* 3. Complete example may look like 1. Using IZ Analyzer cloud instance PROJECT\_ROOT\_DIR> sonar-scanner\ -Dsonar.projectKey=xxx\ -Dsonar.organization=\ -Dsonar.sources=.\ -Dsonar.exclusions=target\ -Dsonar.host.url= -Dsonar.login= \\ 2. Using IZ Analyzer on-prem instance PROJECT\_ROOT\_DIR> sonar-scanner # -Dsonar.projectKey=xxx\ -Dsonar.projectName=xxx\ -Dsonar.sources=.\ -Dsonar.host.url=\ -Dsonar.login= \\ {% hint style="info" %} * For complete reference of all the properties that can be used with sonar-scanner, refer to [Analysis Parameters](https://docs.sonarqube.org/latest/analysis/analysis-parameters/#AnalysisParameters-projectBaseDir) {% endhint %} ### Using Maven Plugin {% hint style="info" %} Before analyzing the source code using **`Maven Plugin`**, make sure you have: * Downloaded and installed **`Apache Maven`**. Refer to [Installing Apache Maven](https://maven.apache.org/) * Follow the instructions [here](/product-guides/integral-zone/iz-suite/iz-scan/anypoint-studio/installation/install-iz-analyzer-studio.md) to generate security token {% endhint %} 1. Go to the project root directory from command line/terminal 2. Run **`mvn sonar:sonar`** command with following options * -Dsonar.projectKey=xxx\ \&#xNAN;*Unique key for the project being uploaded* * -Dsonar.projectName=xxx\ \&#xNAN;*Diplay name of the project being uploaded* * -Dsonar.projectVersion=x.x\ \&#xNAN;*Version of the project being uploaded* * -Dsonar.sources=.\ \&#xNAN;*Source code directory* * -Dsonar.login=xxx\ \&#xNAN;*Security token generated from the server. This parameter is deprecated from SonarQube version > 10.x, use sonar.token instead* * -Dsonar.token=xxx\ \&#xNAN;*Security token generated from the server. This parameter is applicable from SonarQube version > 10.x, for versions < 10.x use sonar.login parameter* * -Dsonar.organization=xxx + *Optional. Applicable only for cloud version* * -Dsonar.branch.name=xxx + *Optional. SCM branch for which code is being analysed. Eg: -Dsonar.branch.name=master* 3. Complete example may look like * Using IZ Analyzer cloud instance PROJECT\_ROOT\_DIR> mvn sonar:sonar\ -Dsonar.projectKey=xxx\ -Dsonar.organization=\ -Dsonar.exclusions=target\ -Dsonar.sources=.\ -Dsonar.host.url= -Dsonar.login= * Using IZ Analyzer on-prem instance PROJECT\_ROOT\_DIR> mvn sonar:sonar\ -Dsonar.projectKey=xxx\ -Dsonar.projectName=xxx\ -Dsonar.sources=.\ -Dsonar.host.url=\ -Dsonar.login= \\ {% hint style="info" %} Follow the instructions from [Scanner for Maven](https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner+for+Maven) for addition information about configuring the plugin {% endhint %} ### Setting Proxy Details If the system from which the projects are analyzed using **`sonar-scanner`** or **`maven`** is configured with proxy, then set the following environment variable with proxy server details before running the respective commands * Windows > set SONAR\_SCANNER\_OPTS="-Dhttps.proxyHost=PROXY\_HOST -Dhttps.proxyPort=PROXY\_PORT -Dhttp.proxyHost=PROXY\_HOST -Dhttp.proxyPort=PROXY\_PORT -Djava.net.useSystemProxies=true" * Linux > export SONAR\_SCANNER\_OPTS="-Dhttps.proxyHost=PROXY\_HOST -Dhttps.proxyPort=PROXY\_PORT -Dhttp.proxyHost=PROXY\_HOST -Dhttp.proxyPort=PROXY\_PORT -Djava.net.useSystemProxies=true" {% hint style="info" %} * Replace **`PROXY_HOST`** and **`PROXY_PORT`** with appropriate values for Proxy server host and port * If **`https.proxyPort`** is not specified, default value will be 443 * If **`http.proxyPort`** is not specified, default value will be 80 {% endhint %} ### See Also * [Code Analysis In Anypoint Studio](/product-guides/integral-zone/iz-analyzer/source-code-analysis/code-analysis-in-studio.md) *** [SonarQube™](https://www.sonarqube.org) is a trademark belonging to SonarSource SA. For further information, please visit [www.sonarqube.org](https://www.sonarqube.org). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://knowledgebase.autorabit.com/product-guides/integral-zone/iz-analyzer/source-code-analysis/code-analysis-in-cicd.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.