Skip to content

Integrate SonarQube scanner to GitHub Actions

License

Notifications You must be signed in to change notification settings

UgVo/sonarqube-action

 
 

Repository files navigation

SonarQube GitHub Action

Using this GitHub Action, scan your code with SonarQube scanner to detects bugs, vulnerabilities and code smells in more than 20 programming languages!

SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells, and security vulnerabilities on 20+ programming languages.

Requirements

Usage

The workflow, usually declared in .github/workflows/build.yaml, looks like:

on:
  # Trigger analysis when pushing in master or pull requests, and when creating
  # a pull request. 
  push:
    branches:
      - master
  pull_request:
      types: [opened, synchronize, reopened]

name: SonarQube Scan
jobs:
  sonarqube:
    name: SonarQube Trigger
    runs-on: ubuntu-latest
    steps:
    - name: Checking out
      uses: actions/checkout@master
      with:
        # Disabling shallow clone is recommended for improving relevancy of reporting
        fetch-depth: 0
    - name: SonarQube Scan
      uses: kitabisa/[email protected]
      with:
        host: ${{ secrets.SONARQUBE_HOST }}
        login: ${{ secrets.SONARQUBE_TOKEN }}

You can change the analysis base directory and/or project key by using the optional input like this:

uses: kitabisa/sonarqube-action@master
with:
  host: ${{ secrets.SONARQUBE_HOST }}
  login: ${{ secrets.SONARQUBE_TOKEN }}
  projectBaseDir: "src/"
  projectKey: "my-custom-project"

Inputs

These are some of the supported input parameters of action.

Parameter Description Required? Default Note
host SonarQube server URL 🟢
login Login or authentication token of a SonarQube user 🟢 Execute Analysis permission required.
password The password that goes with the login username 🔴 This should be left blank if an login are authentication token.
projectBaseDir Set custom project base directory analysis 🔴 .
projectKey The project's unique key 🔴 Allowed characters are: letters, numbers, -, _, . and :, with at least one non-digit.
projectName Name of the project 🔴 It will be displayed on the SonarQube web interface.
projectVersion The project version 🔴
encoding Encoding of the source code 🔴 UTF-8

Note

If you opt to configure the project metadata and other related settings in a sonar-project.properties file (must be placed within the base directory, projectBaseDir) instead of using input parameters, this action is compatible with that approach!

License

The Dockerfile and associated scripts and documentation in this project are released under the MIT License.

Container images built with this project include third party materials.

About

Integrate SonarQube scanner to GitHub Actions

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Shell 75.5%
  • Dockerfile 24.5%