Home Original page

GitHub - rufer7/github-sonarcloud-integration: Scan and analyze GitHub repository with SonarQube Cloud

Quality Gate Status Bugs Code Smells Coverage Duplicated Lines (%) Lines of Code Reliability Rating Security Rating Technical Debt Maintainability Rating Vulnerabilities

Scan and analyze GitHub repository with SonarQube Cloud

Note

SonarCloud got renamed to SonarQube Cloud

Setup

Automatic Analysis

Important

With Automatic Analysis for .NET, certain rules for .NET source code are automatically deactivated. This includes security rules, all rules that come from outside the Sonar Way quality profile, as well as certain rules from within it.

Note

Automatic analysis is only supported for GitHub repositories. If you are using a different version control system, you will need to use a different method to analyze your code.

  1. Follow the docs under SonarQube Cloud - Getting Started with GitHub to setup SonarQube Cloud with GitHub
    1. Sign up at SonarQube Cloud
    2. Click Import another organization
    3. Select your personal GitHub account or the organization that contains the repository you want to scan
    4. When reaching the Create your SonarQube Cloud organization page adjust/update data and click Create organization
    5. On Analyze projects page select the repository you want to scan and click Set Up
    6. On Set up project for Clean as You Code page select the desired code definition and click Create project
  2. After completing the setup, the repository will be scanned automatically and you will see the results on the SonarQube Cloud dashboard

CI-based analysis

Important

Assumption: Automatic analysis is already set up for the repository

To set up CI-based analysis with GitHub actions ...

Tip

For an example usage of sonarqube-scan-action, see here

Include languages other than C#

To include i.e. terraform files in the analysis of SonarScanner for .NET, the following adjustments are required.

  1. Extend the dotnet-sonarscanner begin command with project base dir argument /d:sonar.projectBaseDir="D:\a\GITHUB_PROJECT_NAME\GITHUB_PROJECT_NAME" where GITHUB_PROJECT_NAME is the name of the GitHub project

  2. Include the corresponding source files/folders in one of the projects csproj file

    <ItemGroup>
   <!-- This is required to include terraform files in SonarQube Cloud analysis -->
   <Content Include="..\..\deploy\**\*.tf" Visible="false">
      <CopyToOutputDirectory>Never</CopyToOutputDirectory>
   </Content>
</ItemGroup>

    For more details see here

Include .NET test coverage

To include .NET test coverage in the analysis of SonarScanner for .NET, the following adjustments are required in the GitHub actions workflow (see .github\workflows\quality.yml).

# Install dotnet-coverage
- name: Install dotnet-coverage
  shell: pwsh
  run: |
    dotnet tool install --global dotnet-coverage
- name: Build and analyze
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  shell: pwsh
  run: |
    $ErrorActionPreference = "Stop"
    $PSNativeCommandUseErrorActionPreference = $true
  # Add /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml
    ${{ runner.temp }}\scanner\dotnet-sonarscanner begin /k:"rufer7_github-sonarcloud-integration" /o:"rufer7" /d:sonar.token="$env:SONAR_TOKEN" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.projectBaseDir="D:\a\github-sonarcloud-integration\github-sonarcloud-integration" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml /d:sonar.terraform.provider.azure.version=3.100.0
    dotnet build .\src\ArbitrarySolution.sln --configuration Release
  # Execute tests and collect coverage
    dotnet-coverage collect 'dotnet test .\src\ArbitraryProject.Tests\ArbitraryProject.Tests.csproj' -f xml -o 'coverage.xml'
    ${{ runner.temp }}\scanner\dotnet-sonarscanner end /d:sonar.token="$env:SONAR_TOKEN"

Scan Results

SonarQube Cloud

The scan results can be viewed on the SonarQube Cloud dashboard

GitHub

Important

The new SonarQube Cloud plans Free and Team do not support GitHub Advanced Security integration anymore - only Enterprise plan does

For more details, see here

Security hotspots detected by SonarQube Cloud can be viewed directly on the GitHub repository under Security tab in the Code scanning section

Example

Code scanning alert

Pull Request (GitHub)

Pull request analysis results can be found directly on the pull requests.

For an example, see here

Useful Links