sonarsource/sonarcloud-scanA Bitbucket Pipe to trigger SonarCloud analysis
Scan your code with SonarQube Cloud to detects bugs, vulnerabilities and code smells in more than 25 programming languages.
Your SonarCloud account must first be associated to your Bitbucket team or user account. SonarQube Cloud is totally free for open-source projects. If your code is closed source, SonarQube Cloud also offers a paid plan to run private analyses.
NOTE: For projects using Maven or Gradle please execute a respective scanner directly instead of using this pipe (see examples).
Add the following snippet to the script section of your bitbucket-pipelines.yml file:
- pipe: sonarsource/sonarcloud-scan:4.1.0
# variables:
# SONAR_TOKEN: '<string>' # Optional
# EXTRA_ARGS: '<array of strings>' # Optional
# SONAR_SCANNER_JAVA_OPTS: '<string>' # Optional
# DEBUG: '<boolean>' # Optional
| Variable | Usage |
|---|---|
| SONAR_TOKEN (*) | SonarQube Cloud token. It is recommended to use a secure repository or account variable. And in this case there is no need to specify this variable in the bitbucket-pipelines.yml file. |
| EXTRA_ARGS | Extra analysis parameters (check docs) |
| SONAR_SCANNER_JAVA_OPTS | Scanner JVM options (e.g. "-Xmx256m") |
| DEBUG | Turn on extra debug information. Default: false. |
(*) = required variable.
This pipe encapsulates the execution of SonarQube Cloud code analyzer in order to detect bugs, vulnerabilities and code smells. SonarQube Cloud can then decorate your Pull Requests and report back with code quality information. Getting started guide available here: Get started with Bitbucket Cloud.
To use this pipe you have to set up a project on SonarQube Cloud, then use the generated token in a secure variable named SONAR_TOKEN on your repository or team/personal Bitbucket Account.
Basic example:
- pipe: sonarsource/sonarcloud-scan:4.1.0
A bit more advanced example:
- pipe: sonarsource/sonarcloud-scan:4.1.0
variables:
EXTRA_ARGS: ['-Dsonar.projectDescription="Project with sonarcloud-scan pipe"', '-Dsonar.eslint.reportPaths=report.json']
SONAR_SCANNER_JAVA_OPTS: "-Xmx512m"
DEBUG: "true"
This example uses a custom description of the project on SonarQube Cloud, reads the report produced by eslint, sets maximum memory to 512MB, and enables verbose output.
If you would like help with this pipe, or you have an issue or feature request, let us know on our community forum.
If you are reporting an issue, please include: