SonarQube - The Complete Guide

Configure the sonar scanner for maven, create project tokens, set global settings, run analysis, and review vulnerabilities and rules in the SonarQube dashboard.

Explore how issue severity in SonarQube flags flaws and security issues, from blocker to critical security issues, using rules and tags like pitfall and dna, and viewing issues by file.

Explore SonarQube rules by language, examine repositories that contribute rules, learn about ready or deprecated statuses, and use rule templates to create custom rules; avoid basic authentication.

Explore built-in rule tags that categorize rules and issues across languages, with language-specific and cross-language checks; learn how tagging aids clarity, security, and coding conventions.

Define quality gates by creating conditions with metrics like coverage, critical issues, and vulnerabilities, using comparison operators and order values to determine release readiness.

Explore SonarQube metric definitions, including complexity measures, cognitive complexity, issue tracking stages, quality and security remediation, vulnerability levels, and coverage metrics.

Explore technical debt in SonarQube by evaluating development costs per line of code and language-specific parameter overrides; learn how debt ratio yields a rating from very good to very bad.

Explore quality profiles in SonarQube, create and customize language rules, adjust severity and limits for Java projects, and manage activation, permissions, and project associations.

Set public or private project access, assign groups and users to control who can browse projects and see source code, and manage open, confirm, resolve, close, reopen issues with permissions.

Analyze security-related rules in SonarQube, distinguishing vulnerabilities and hotspots, and examine how source-to-sink flow and input validation reveal issues like injection, improper validation, and weak cryptographic practices.

Configure the SonarQube scanner in Jenkins by setting credentials and connecting to localhost:9000, then set project properties (language Java) and run analysis to view the quality gauge percent.

Configure GitLab integration in SonarQube by creating a GitLab application at localhost:9000, enabling login, and generating a personal access token; then set up configuration and variables for repository analysis.

Configure the analysis scope by selecting files to ignore for code coverage and duplication detection, apply regular expressions, and restrict coding rules across languages, components, and blogs.