Tech Talks

SonarQube                                                         

What is SonarQube?

SonarQube previously known as Sonar is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells, and security vulnerabilities in code.

  Why SonarQube?

1. Supports 27 programming languages at single platform.
2. Open source.
3. Generate the report and SonarQube Server which provide a graphical interface to view and review your code and results of Sonar Scanner.
4. Easy to collaborate with teammate.
5. Supports Multi-OS platform windows, Mac, and Linux etc.
6. Can be configured with Jenkins in CI pipeline with centralized server.
7.  Provide detailed information with expected solution and reason.

Pre-Requirement:

1. Oracle JDK 8 or OpenJDK 8 Free (if using SonarQube till version 7.8) For SonarQube version 7.9 onwards needs JRE/JDK 11 or OpenJDK 11 or latest.
2. SonarQube server (Depends on JDK version)
3. Sonar scanner (Self-sufficient package) https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/

How to setup a SonarQube server on your localhost.

1. Install JDK.
2. Download and unzip the latest version or a previous version of free and open source Community Edition from https://www.sonarqube.org/downloads/
3. Run batch file \bin\windows-x86-64\StartSonar
4. The server starts in port http://localhost:9000 by default http://10.140.29.171:9000 

How to setup a Sonar Scanner

1. Download the latest version of Sonar Scanner from https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/ .
2. Set path of bin to environment variable path to get command access of C:\sonarScanner\bin\ sonar-scanner in shell terminal

How to configure a Node application for Sonar integration

1. Add a configure file named “sonar-project.properties” to the root of your source code directory to project be able to be scanned by Sonar Scanner.
2. sonar.projectKey=application_name
3. sonar.projectName=Application Name
4. sonar.projectVersion=1.0sonar.language=jssonar.sources=src
5. sonar.sourceEncoding=UTF-8sonar.exclusions=src/**/*.spec.js
6. sonar.test.inclusions=src/**/*.spec.js
7. sonar.coverage.exclusions=src/**/*.spec.js,src/**/*.mock.js,node_modules/*,coverage/lcov-report/*sonar.javascript.lcov.reportPaths=coverage/lcov.info
8. sonar.testExecutionReportPaths=test-report.xml
9. Add project to SonarQube server and get the sonar scanner command form there. like