Share this page

# SonarQube integration

This topic explains how to set up an integration with SonarQube, to include code coverage and code vulnerabilities analysis into your development cycle.

In this topic:

## Setting up an integration with SonarQube

To see data from SonarQube, create a Jenkins job with Maven build configured to send data to SonarQube.

Note: The integration enables you to see coverage and vulnerabilities. Other issue types are not yet supported.

To configure the Jenkins job:

1. In Sonar, create a server authentication token with administrator authorization. Add this token to the SonarQube configuration in Jenkins, to enable Jenkins to create a webhook in Sonar to notify Jenkins when analysis is done.

2. Set up the OpenText Software Delivery Management integration with your Jenkins server using the Application Automation Tools plugin. For details, see Set up CI/CD integration.

3. In the Jenkins system configuration, in the SonarQube servers section:

   1. Enter your SonarQube server details, including the authentication token you created.

   2. Select the Enable injection of SonarQube server configuration as build environment variables checkbox.

4. In the Jenkins job whose coverage and vulnerability data you want to see, add the following:

   1. In the Build Environment section, select the checkbox Prepare SonarQube Scanner environment.

   2. Add the OpenText Software Delivery Management SonarQube listener build step before your Maven command. Select one or both of the checkboxes for the data you want integrated: Push Vulnerabilities and Push Coverage.

   3. In the build step, in addition to SonarQube goal, inject two environment parameter values to SonarQube with the build and job name from Jenkins: sonar.analysis.buildNumber, and sonar.analysis.jobName.

      This enables OpenText Software Delivery Management to identify the job when getting the coverage results from SonarQube.

      Copy code

      Example:

          clean install $SONAR_MAVEN_GOAL -Dsonar.host.url=$SONAR_HOST_URL
          -Dsonar.login=$SONAR_AUTH_TOKEN -Dsonar.analysis.buildNumber=${BUILD_NUMBER}
          -Dsonar.analysis.jobName=${JOB_NAME}

5. Define the pipeline in OpenText Software Delivery Management as type security. You can see a pipeline's type in the pipeline's Details tab.

Note: Jenkins does not support Basic authentication. If you are integrating SonarQube with Jenkins, we recommend that you verify your organization's security policy.

## Pipeline as Code

This section describes the steps to take if you are using Pipeline as Code.

### Perform the following steps:

1. Enter the following step in your build stage before your Maven command: addALMOctaneSonarQubeListener.

2. In this step, define the following variables: sonarServerUrl, sonarToken, pushCoverage (optional), pushVulnerabilities (optional).

3. In the Maven command, define sonar.analysis.buildNumber and sonar.analysis.jobName similar to a regular Jenkins job.

   Copy code
   Example: Using Pipeline as Code

       withSonarQubeEnv('my_sonar_instance') {
           addALMOctaneSonarQubeListener pushCoverage: true, pushVulnerabilities:true, sonarToken:env.SONAR_AUTH_TOKEN, sonarServerUrl:env.SONAR_HOST_URL
           sh(returnStatus: true, script: "mvn clean install $SONAR_MAVEN_GOAL -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.login=$SONAR_AUTH_TOKEN -Dsonar.analysis.buildNumber=${BUILD_NUMBER} -Dsonar.analysis.jobName=${JOB_NAME}")
       }

## See also

- Create and configure pipelines
- Track code coverage in pipeline runs
- Track security vulnerabilities

https://admhelp.microfocus.com Software Delivery Management 8942
Tips to improve your search results... OpenText™ Software Delivery Management Help Center OpenText™ Software Delivery Management Help 26.3 All View Local Help Center View Online Help Center Version: