Run SonarQube scans

SonarQube scans analyse source code to detect bugs, vulnerabilities, and code quality issues.

SHIP-HATS provides GitLab pipeline templates that allow projects to run SonarQube scans as part of their CI/CD pipelines.

Prerequisites

Ensure the following:

• A SonarQube application has been created for the SHIP-HATS project.
  See Create SonarQube applications.

• You have obtained the following details required to configure the scan:

  • Project key — identifies the SonarQube project.
    Users with Browse project permission in SonarQube can retrieve the project key.

  • Token — used to authenticate the scan when sending results to SonarQube.

  Only Subscription Admins (SA) and Project Admins (PA) can retrieve the token from Console.
  See Manage SonarQube token.

• Your project uses a CI/CD pipeline. See GitLab pipeline templates.

Steps

1. Obtain the token from the SA or PA of the SHIP-HATS project.

2. Retrieve the project key from the SonarQube portal.

   Log in to SonarQube and open the required project.
   The project key can typically be found in the project URL or project settings.

3. Configure your CI/CD pipeline to run the SonarQube scanner using the project key and token.

4. Use the SHIP-HATS GitLab pipeline templates to integrate SonarQube scans into your pipeline.

   See:
   GitLab pipeline templates

5. Run the pipeline to execute the SonarQube scan.

Things to note

• The token is required for authenticating scans executed from CI/CD pipelines.
• The project key identifies the SonarQube project where scan results are stored.
• Scan results can be viewed in the SonarQube portal after a successful pipeline run.

Related topics

• Create SonarQube applications
• Manage SonarQube token
• View SonarQube scan results