xenowa / sonarqube-scans-testing

Project to test and debug SonarQube Plugins:

Token for sonarqube analysis

• First generate a sonarqube token to make a project analyzable

SONARQUBE_TOKEN: sqp_ab3d5a0eb6afe219462f3876b146ab9d6d6602c8

• Replace the places mentioned as SONARQUBE_TOKEN with the actual token in the following guide

Utilizing the Sonar Scanner for gradle for performing analysis

1. Set up the build.gradle file

plugins {
  id "org.sonarqube" version "4.2.1.3168"
}

2. Execute the following code in the cmd

./gradlew sonar
  -Dsonar.projectKey=sonarqube-ballerina-testing
  -Dsonar.host.url=http://localhost:9000
  -Dsonar.token=SONARQUBE_TOKEN

3. Alternatively you can set those in as a gradle task

sonar {
    properties {
        property("sonar.projectKey", "sonarqube-ballerina-testing")
        property("sonar.host.url", "http://localhost:9000")
    }
}

• then run the following command

gradlew sonar -Dsonar.token=SONARQUBE_TOKEN

• OR

set SONAR_TOKEN=SONARQUBE_TOKEN
gradlew sonar

Notes regarding the gradle application plugin

1. This plugin automatically sets up the sonar properties required to do a proper analysis of code and send the results to the sonarQube server

2. This plugin is required to perform analysis on compiled languages

3. Once executed, sonar scanner temporarily creates an analysis log in the .scannerwork directory that contains details of the scanners that are already coming ready with it, these analysers are the ones responsible for generating the reports that are then sent to sonarQube

Utilizing the Sonar Scanner for performing analysis

1. Download the Sonar Scanner

2. Create a sonar-project.properties file in the root directory so that the scan will be triggered for the entire project

sonar.projectKey=sonarqube-ballerina-testing
sonar.sources=.
sonar.host.url=http://localhost:9000
sonar.login=SONARQUBE_TOKEN

Procedure for invoking scans for various language source files

For Java/Kotlin/Scala source files:

1. Set up the Java/Kotlin/Scala plugins

plugins {
  // For Java
  id "application"
  // For Kotlin
  id "org.jetbrains.kotlin.jvm" version "1.9.10"
  // For Scala
  id 'scala'
}

2. Set up the Java/Kotlin/Scala dependencies

dependencies {
    // For Running Kotlin files
    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk8"

    // For Running Scala files
    implementation 'org.scala-lang:scala3-library_3:3.0.1'
}

3. Set up the sourceSets property (Specific to Scala)

sourceSets {
    main {
        scala {
            srcDirs = ['src/main/scala']
        }
        java {
            srcDirs = ['src/main/java']
        }
    }
}

4. Set up Sonar Scanner for Gradle

5. Execute the gradle sonar command

gradlew sonar

6. No further actions are required, and analysis results will be visible in SonarQube

For Golang source files:

1. Perform the sonar scan through any sonar-scanner CLI

2. The analysis will be taken care of automatically without any further steps

Inclusion of test and coverage reports for Go:

1. Provide the following in the sonar-project.properties file:

#sonar.tests=.
# Remove go tests files from being in sonar scans directly
sonar.exclusions=**/*_test.go

# Explicitly add go test files to be included in the sonar.test instead
sonar.test.inclusions=**/*_test.go

# Providing absolutely path for generated coverage report required before scans
 sonar.go.coverage.reportPaths="C:\\Users\\Tharana Wanigaratne\\Desktop\\BalWorkFile\\SonarQube-scans-testing\\test-go-project\\coverage.out"

# Providing absolutely path for generated test report required before scans
 sonar.go.tests.reportPaths="C:\\Users\\Tharana Wanigaratne\\Desktop\\BalWorkFile\\SonarQube-scans-testing\\test-go-project\\test-report.json"

2. navigate into the go project

cd test-go-project

3. Create a coverage report using the following command

go test -coverprofile=coverage.out

4. Create a test report using the following command

go test -json > test-report.json

For JS/Python source files:

1. Perform the sonar scan through any sonar-scanner CLI

2. The analysis will be taken care of automatically without any further steps

Debugging a SonarQube Project

Initiating the debug from the scanner side:

From sonar scanner cli (Suitable for non compiled languages)

1. set the following sonar env variable with the debug option:

set SONAR_SCANNER_OPTS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=8000"

2. Run the sonar-scanner

sonar-scanner

From sonar scanner for gradle (Suitable for compiled languages)

1. Execute the following command

gradlew sonar -Dorg.gradle.debug=true --no-daemon -Dorg.gradle.debug.port=8000

Setting up debug points in the plugins:

1. Create a breakpoint in the required java project class file with a java remote debug configuration set up

2. Click the debug icon, to start debugging

Initiating a debug for the scanner:

For sonar scanner cli:

1. Clone the relevant sonar scanner version from here

2. set following env variable for debug option

set SONAR_SCANNER_OPTS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=8000"

3. Run the sonar-scanner

For sonar scanner for gradle:

1. Clone the relevant sonar scanner version from here

2. Execute the following command

gradlew sonar -Dorg.gradle.debug=true --no-daemon -Dorg.gradle.debug.port=8000

3. It's possible to keep the execution reports of an analysis in the .scannerwork directory without deleting them with the following property // sonar.scanner.keepReport=true

Setting up debug points in the scanners:

1. Create a breakpoint in the required java project class file with a java remote debug configuration set up

2. Click the debug icon, to start debugging