{"id":20597212,"url":"https://github.com/cathive/concourse-sonarqube-resource","last_synced_at":"2025-02-28T07:02:18.527Z","repository":{"id":41420183,"uuid":"105370930","full_name":"cathive/concourse-sonarqube-resource","owner":"cathive","description":"performs SonarQube analyses and checks quality gates https://concourse-ci.org/ https://sonarqube.org/","archived":false,"fork":false,"pushed_at":"2024-08-29T09:45:02.000Z","size":287,"stargazers_count":46,"open_issues_count":5,"forks_count":49,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-02-21T06:01:41.226Z","etag":null,"topics":["code-quality","concourse-ci","concourse-ci-resource","concourse-resource","continuous-integration","pipeline","quality-gate","quality-gates","sonar-scanner","sonarcloud","sonarqube","sonarqube-analysis","sonarqube-scanner","static-code-analysis"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cathive.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS.md","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-09-30T13:14:29.000Z","updated_at":"2024-08-29T09:44:59.000Z","dependencies_parsed_at":"2023-02-16T17:16:18.684Z","dependency_job_id":"3836c215-e989-4807-9c7a-47382c0ddc8f","html_url":"https://github.com/cathive/concourse-sonarqube-resource","commit_stats":null,"previous_names":[],"tags_count":49,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cathive%2Fconcourse-sonarqube-resource","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cathive%2Fconcourse-sonarqube-resource/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cathive%2Fconcourse-sonarqube-resource/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cathive%2Fconcourse-sonarqube-resource/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cathive","download_url":"https://codeload.github.com/cathive/concourse-sonarqube-resource/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241109999,"owners_count":19911249,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["code-quality","concourse-ci","concourse-ci-resource","concourse-resource","continuous-integration","pipeline","quality-gate","quality-gates","sonar-scanner","sonarcloud","sonarqube","sonarqube-analysis","sonarqube-scanner","static-code-analysis"],"created_at":"2024-11-16T08:21:06.873Z","updated_at":"2025-02-28T07:02:18.447Z","avatar_url":"https://github.com/cathive.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![CI](https://github.com/cathive/concourse-sonarqube-resource/actions/workflows/ci.yml/badge.svg)](https://github.com/cathive/concourse-sonarqube-resource/actions/workflows/ci.yml)\n\n# [SonarQube](https://sonarqube.org/) Resource for [Concourse CI](https://concourse-ci.org/)\n\nPerforms SonarQube analyses and tracks the state of SonarQube [quality gates](https://docs.sonarqube.org/display/SONAR/Quality+Gates).\n\nThis resource works with [SonarCloud](https://sonarcloud.io/) and self-hosted instances of SonarQube.\n\nIf you want to implement a real quality gate in your build pipeline, you might want to also use the [concourse-sonarqube-qualitygate-task](https://github.com/cathive/concourse-sonarqube-qualitygate-task) which can be used to break a build if certain quality goals (as reported by SonarQube) are not reached.\n\n## Requirements\n\n* A running SonarQube instance (this resource was tested on v6.5–v7.1, but it should\n  work with every version of SonarQube ≥ v5.3)\n* The base URL of your SonarQube server has to be configured correctly! Otherwise\n  the resource will be unable to fetch analysis results when invoking it's `in`\n  action. (`sonar.core.serverBaseURL` in `conf/sonar.properties`)\n\n## Installation\n\nAdd a new resource type to your Concourse CI pipeline:\n\n```yaml\n resource_types:\n - name: sonar-runner\n  type: docker-image\n  source:\n    repository: cathive/concourse-sonarqube-resource\n    tag: latest # For reproducible builds use a specific tag and don't rely on \"latest\".\n```\n\n## Source Configuration\n\n* `host_url`: *Required.* The address of the SonarQube instance,\n  e.g. \"https://sonarcloud.io/\" (when using SonarCloud). Must end with a slash.\n\n* `organization`: The organization to be used when submitting stuff to a sonarqube\n  instance. This field is *required* when using SonarCloud to perform the analysis\n  of your code.\n\n* `login`: The login or authentication token of a SonarQube user with Execute Analysis\n  permission. Can be left out if SonarQube instance does not require any authentication.\n\n* `password`: The password that goes with the sonar.login username. This should be left blank if an\n  authentication token is being used.\n\n* `maven_settings`: Maven settings to be used when performing SonarQube analysis.\n  Only used if the scanner_type during the out phase has been set to / determined to use\n  Maven.\n\n* `__debug`: This flag is used to debug any problems that might occur when using the resource\n  itself. It enables extra debug output on the console and sets the `-x` flag during shell\n  execution. It is usually not a good idea to set this flag to `true` in a production environment,\n  because it might leak passwords and access key credentials to the console where it might\n  be accessed by unauthorized / anonymous users.\n\n## Behavior\n\nThe resource implements all three actions (check, in and out).\nThe analysis is triggered by the out action and check/in will be used to wait for\nthe result of the analysis and pull in the project status. Tasks can use this\ninformation to break the build (if desired) if any of the criteria of the\nquality gate associated with a project are not met.\n\n### out: Trigger SonarQube analysis\n\n#### Parameters\n\n* `project_path`: *Required* Path to the resource that shall be analyzed.\n  If the path contains a file called \"sonar-project.properties\" it will be picked\n  up during analysis.\n\n* `scanner_type`: Type of scanner to be used. Possible values are:\n  * `auto` (default) Uses the maven-Scanner if a pom.xml is found in the directory\n    specified by sources, cli otherwise.\n  * `cli` Forces usage of the command line scanner, even if a Maven project object\n    model (pom.xml) is found in the sources directory.\n  * `maven` Forces usage of the Maven plugin to perform the scan.\n\n* `project_key`: Project key (default value is read from sonar-project.properties)\n\n* `project_key_file`: File to be used to read the Project key.\n  When this option has been specified, it has precedence over the `project_key` parameter.\n\n* `project_name`: Project name (default value is read from sonar-project.properties)\n\n* `project_description`: Project description (default value is read from sonar-project.properties)\n\n* `project_version`: Project version (default value is read from sonar-project.properties)\n\n* `project_version_file`: File to be used to read the Project version.\n  When this option has been specified, it has precedence over the `project_version` parameter.\n\n* `autodetect_branch_name`: Try to figure out the branch automatically.\n  This works if the `project_path` contains recognized SCM metadata from a supported\n  revision control system. (Currently: only Git is supported!)\n\n* `branch_name`: Name of the branch. Overrides `autodetect_branch_name` if it has been set.\n\n* `branch_name_file`: File to be used to read the branch name.\n  When this option has been specified, it has precedence over the `branch_name` parameter.\n\n* `branch_target`: Name of the branch where you intend to merge your short-lived branch at the end of its life.\n  If left blank, this defaults to the master branch. It can also be used while initializing a long-lived\n  branch to sync the issues from a branch other than the Main Branch.\n  (See [Branch Plugin documentation](https://docs.sonarqube.org/display/PLUG/Branch+Plugin) for further\n  details)\n\n* `branch_target_file`: File to be used to read the branch target.\n  When this option has been specified, it has precedence over the `branch_target` parameter.\n\n* `decorate_pr`: If set to `true` it will try to fetch the pull request id, the head branch name and the base branch name from\nthe pull request resource. It will enable `sonar.pullrequest.key`, `sonar.pullrequest.branch` and `sonar.pullrequest.base` flags when performing your analysis.\n\n  It works for:\n  * `telia-oss/github-pr-resource`\n  * `zarplata/concourse-git-bitbucket-pr-resource`\n  * `jtarchie/github-pullrequest-resource`\n\n  \u003e_In order to use this feature you must be using `SonarCloud` or `SonarQube Developer` edition._\n\n* `sources`: A list of paths to directories containing source files.\n\n* `tests`: A list of paths to directories containing source files.\n\n* `additional_sonar_scanner_opts`: Optional values to be passed in to the $SONAR_SCANNER_OPTS env variable.\n  Can be used to provide parameters to Sonar before the scanner process starts. This is at the moment\n  essentially necessary for HTTP proxy settings.\n\n* `additional_properties`: Optional object/dictionary that may contain any additional properties\n  that one might want to pass when running the sonar-scanner.\n\n* `additional_properties_file`: Optional path to a file containing properties\n  that should be passed to the sonar-scanner.\n\n* `maven_settings_file`: Path to a Maven settings file that shall be used.\n  Only used if the scanner_type during has been set to / determined to use Maven.\n  If the resource itself has a maven_settings configuration, this key will override\n  it's value.\n\n* `sonar_maven_plugin_version`: sonar-maven-plugin version (default is empty and using the latest version)\n\n#### Wildcards Support\n\nSupport convert wildcards to comma-separated paths.\n\n* `sources`\n* `tests`\n* Any key with the suffix `.reportPaths` in `additional_properties`\n\n### in: Fetch result of SonarQube analysis\n\nThe action will place two JSON files into the resource's folder which are fetched from\nthe SonarQube Web API:\n\n#### Parameters\n\n* `quality_gate`: *Optional* *JSON* Enable quality_gate checker and control `get` step success/failure.\n  * `ignore_all_warn`: *bool* Ignore all `WARN` metrics and let `get` step success\n  * `ignore_all_error`: *bool* Ignore all `ERROR` metrics and let `get` step success\n  * `ignore_warns`: *array* A list of metric keys for `WARN` metric to ignore while quality_gate checking.\n  * `ignore_errors`: *array* A list of metric keys for `ERROR` metric to ignore while quality_gate checking.\n\nNote: for `ignore_warns`/`ignore_errors`, possible value could be found through\n* `https://\u003cyour-sonar_host\u003e/quality_gates/show/\u003cquality_gate_id\u003e`\n* `https://\u003cyour-sonar_host\u003e/api/qualitygates/show?id=\u003cquality_gate_id\u003e`\n\n### Outputs\n\n* qualitygate_project_status.json\n  Quality gate status of the compute engine task that was triggered by the resource\n  during the out action.\n  Format: https://next.sonarqube.com/sonarqube/web_api/api/qualitygates/project_status\n* ce_task_info.json\n  Information about the compute engine task that performed the analysis.\n  Format: https://next.sonarqube.com/sonarqube/web_api/api/ce/task\n\n## Full example\n\nThe following example pipeline shows how to use the resource to break the build if\na project doesn't meet the requirements of the associated quality gate.\n\n```yaml\nresource_types:\n\n- name: sonar-runner\n  type: docker-image\n  source:\n    repository: cathive/concourse-sonarqube-resource\n    tag: latest # For reproducible builds use a specific tag and don't rely on \"latest\".\n\nresources:\n\n- name: sources\n  type: git\n  source:\n    uri: https://github.com/example/example.git\n\n- name: artifact\n  type: s3\n  # ... configuration omitted\n\n- name: code-analysis\n  type: sonar-runner\n  source:\n    host_url: https://sonarqube.example.com/\n    login: ((sonarqube-auth-token))\n\njobs:\n\n# The build job performs fetches stuff from the \"sources\" resource\n# and executes a task that builds and tests everything. Once compilation,\n# test execution and \u003cwhatever\u003e has been performed, we copy the whole\n# working directory into the output folder \"sonarqube-analysis-input\"\n# and push the package that has been created by the \"build\" task to the\n# artifact resource and utilize the sonarqube-resource to perform static\n# code analysis.\n- name: build-and-analyze\n  plan:\n  - get: sources\n    trigger: true\n  - task: build\n    config:\n      platform: linux\n      image_resource:\n        type: docker-image\n        source:\n          repository: debian\n          tag: 'jessie'\n      inputs:\n      - name: sources\n      outputs:\n      # Hint: The sonar-runner needs more than just the\n      # sources to perform a full analysis. Line coverage reports, unit test reports,\n      # Java class files and mutation test results should also be present.\n      # Therefore, you'll have to make sure that your build script provides the sources\n      # and the compilation/test results in your Concourse CI build plan.\n      # (And that is the reason, why we need the following output)\n      - name: sonarqube-analysis-input\n      run:\n        path: build.sh\n        dir: sources\n  - in_parallel:\n    - put: code-analysis\n      params:\n        project_path: sonarqube-analysis-input\n        project_key: com.example.my_project\n        sources: [\".\"]\n        tests: [\".\"]\n        additional_properties:\n          # Will be passed as \"-Dsonar.javascript.lcov.reportPaths=\"coverage/lcov.info\" to the scanner.\n          sonar.javascript.lcov.reportPaths: coverage/lcov.info\n      get_params:\n        quality_gate:\n          ignore_errors: ['new_coverage', 'violations']\n          ignore_warns: ['new_duplicated_lines_density', 'violations']\n    - put: artifact\n\n# The qualitygate task breaks the build if the analysis result from SonarQube\n# indicates that any of our quality metrics have not been met.\n- name: qualitygate\n  plan:\n  - in_parallel:\n    - get: artifact\n      passed:\n      - build-and-analyze\n    - get: code-analysis\n      passed:\n      - build-and-analyze\n      trigger: true\n  - task: check-sonarqube-quality-gate\n    config:\n      platform: linux\n      image_resource:\n        type: docker-image\n        source:\n          repository: cathive/concourse-sonarqube-qualitygate-task\n          tag: latest # Use one of the versioned tags for reproducible builds!\n      inputs:\n      - name: code-analysis\n      run:\n        path: /sonarqube-qualitygate-check\n        dir: code-analysis\n\n# We deploy only artifacts that have made it through our quality gate!\n- name: deploy\n  plan:\n  - get: artifact\n    passed:\n    - qualitygate\n\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcathive%2Fconcourse-sonarqube-resource","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcathive%2Fconcourse-sonarqube-resource","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcathive%2Fconcourse-sonarqube-resource/lists"}