Skip to main content

SonarQube

Scorecards

Summary

SonarQube provides deep visibility into static code analysis metrics. You can use SonarQube to drive insights into values such as:

  • Code coverage
  • Vulnerabilities
  • Code smells

Setup

In order to connect Cortex to your SonarQube instance, you’ll need to create a SonarQube User Token, and add it under Settings → SonarQube.

caution
If you’re using a self-hosted instance of SonarQube, you’ll need to verify that your Cortex instance is able to reach the SonarQube instance. See our IP Whitelist section for more.

Advanced Configuration

If you’re unable to expose your SonarQube instance to be reachable by Cortex, you can set up a Custom Integration Webhook. To learn more about SonarQube webhooks, visit their Webhook Documentation.

Service Registration

Discovery

By default, Cortex will use the service identifier (e.g. my-service) as the "best guess" for the SonarQube project key. For example, if your service identifier is “my-service”, then the corresponding project key in SonarQube should also be “my-service”.

caution

If you’re using build-system tooling to push analysis to SonarQube, the plugin (e.g. Gradle, Maven) may be automatically generating a project key that’s different from the repo name.

If your SonarQube project keys don’t cleanly match the Cortex service identifier, you can override this in the Cortex Service Descriptor.

Service Descriptor

If you need to override the automatic discovery, you can define the following block in your Cortex Service Descriptor.

x-cortex-static-analysis:
sonarqube:
project: my-project # projectKey in SonarQube

The value for project should be the project key as defined in SonarQube.

Troubleshooting

  1. I’m seeing “Socket timed out when trying to connect to SonarQube” for all of my services in Scorecards
    1. This means that Cortex is unable to talk to your SonarQube instance. Make sure that your instance is running and accessible to Cortex.
  2. I’m using Gradle, and I’ve verified that my project is in SonarQube. Cortex is still showing me an error.
    1. Gradle automatically generates a project key which is equal to [${project.group}:]${project.name}. As a result, automatic discovery won’t work. You’ll need to override the project key in your Cortex Service Descriptor.
  3. My project is in Sonar, Cortex is able to talk to SonarQube, but my score isn’t showing up. Try the following troubleshooting steps:
    1. Make sure the project key in your YAML is exactly the same as the key in SonarQube.
    2. Verify that the scores are in the “default branch” in SonarQube. If your scores are showing up in a “branch-a” in SonarQube, but your SonarQube default branch is “master”, Cortex will not be able to retrieve the scores.
    3. Run the following curl command and verify there are metrics showing up in the response
       curl -v -u <token>: "https://[SONARQUBE HOST]/api/measures/
    component_tree?component=[SONARQUBE PROJECT KEY]&metricKeys=ncloc,coverage"