SonarCloud¶

# Installation (via npm for Node.js projects)
npm install -D sonarqube-scanner

# Or download CLI
# https://docs.sonarcloud.io/advanced-setup/ci-based-analysis/sonarscanner-cli/

# Scan project (requires sonar-project.properties)
sonar-scanner \
  -Dsonar.organization=my-org \
  -Dsonar.projectKey=my-project \
  -Dsonar.sources=. \
  -Dsonar.host.url=https://sonarcloud.io \
  -Dsonar.token=$SONAR_TOKEN  # (1)!

# JavaScript/TypeScript with coverage
npm test -- --coverage  # Generate coverage
sonar-scanner \
  -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info  # (2)!

# Java/Maven project
mvn clean verify sonar:sonar \
  -Dsonar.projectKey=my-project \
  -Dsonar.organization=my-org \
  -Dsonar.host.url=https://sonarcloud.io \
  -Dsonar.token=$SONAR_TOKEN

# .NET project
dotnet sonarscanner begin \
  /k:"my-project" \
  /o:"my-org" \
  /d:sonar.host.url="https://sonarcloud.io" \
  /d:sonar.token="$SONAR_TOKEN"
dotnet build
dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN"  # (3)!

# sonar-project.properties (project root)
sonar.projectKey=my-org_my-project
sonar.organization=my-org

# Source directories
sonar.sources=src
sonar.tests=tests

# Exclusions (don't analyze)
sonar.exclusions=**/*.test.js,**/vendor/**,**/node_modules/**  # (1)!

# Coverage exclusions (don't measure coverage)
sonar.coverage.exclusions=**/*.test.js,**/migrations/**

# Language-specific settings
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.python.coverage.reportPaths=coverage.xml

# Quality gate settings
sonar.qualitygate.wait=true  # (2)!
sonar.qualitygate.timeout=300

# GitHub Actions integration (.github/workflows/sonarcloud.yml)
name: SonarCloud Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  sonarcloud:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for blame info  # (1)!

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run tests with coverage
        run: npm test -- --coverage  # (2)!

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # (3)!
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.projectKey=my-org_my-project
            -Dsonar.organization=my-org
            -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
            -Dsonar.qualitygate.wait=true

      - name: Check Quality Gate
        run: |
          if [ "${{ job.status }}" != "success" ]; then
            echo "Quality gate failed!"
            exit 1
          fi

# GitLab CI integration (.gitlab-ci.yml)
sonarcloud-check:
  stage: test
  image: sonarsource/sonar-scanner-cli:latest
  script:
    - npm test -- --coverage
    - sonar-scanner
      -Dsonar.projectKey=$SONAR_PROJECT_KEY
      -Dsonar.organization=$SONAR_ORGANIZATION
      -Dsonar.host.url=https://sonarcloud.io
      -Dsonar.token=$SONAR_TOKEN
      -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
      -Dsonar.qualitygate.wait=true
  only:
    - merge_requests
    - main
  cache:
    paths:
      - node_modules/
      - .scannerwork/  # (1)!