SonarQube / SonarCloud
When NOT to Use This Skill
- JavaScript/TypeScript linting - Use
eslint-biome skill for faster feedback - Security scanning - Use
owasp-top-10 or security-scanner MCP - Test execution - Use Vitest/Playwright skills for running tests
- Code coverage generation - Use JaCoCo/Vitest skills for coverage
Deep Knowledge: Use mcp__documentation__fetch_docs with technology: sonarqube for comprehensive documentation.
Official Documentation
Quick Setup
SonarCloud (Recommended for Open Source)
# 1. Connect repo at sonarcloud.io
# 2. Create sonar-project.properties
# sonar-project.properties
sonar.projectKey=org_project
sonar.organization=your-org
sonar.sources=src
sonar.tests=tests
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.coverage.exclusions=**/*.test.ts,**/*.spec.ts
SonarQube (Self-hosted)
# docker-compose.yml
services:
sonarqube:
image: sonarqube:lts-community
ports:
- "9000:9000"
environment:
- SONAR_JDBC_URL=jdbc:postgresql://db:5432/sonar
volumes:
- sonarqube_data:/opt/sonarqube/data
Quality Gates
Default Quality Gate Conditions
| Metric | Condition | Target |
|---|
| Coverage | on new code | ≥ 80% |
| Duplicated Lines | on new code | ≤ 3% |
| Maintainability Rating | on new code | A |
| Reliability Rating | on new code | A |
| Security Rating | on new code | A |
| Security Hotspots Reviewed | on new code | 100% |
Custom Quality Gate
# Create via API
curl -X POST "https://sonarcloud.io/api/qualitygates/create" \
-H "Authorization: Bearer $SONAR_TOKEN" \
-d "name=Strict"
CI/CD Integration
GitHub Actions
# .github/workflows/sonar.yml
name: SonarCloud
on: [push, pull_request]
jobs:
sonarcloud:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: SonarCloud Scan
uses: SonarSource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
Maven (Java)
<!-- pom.xml -->
<plugin>
<groupId>org.sonarsource.scanner.maven</groupId>
<artifactId>sonar-maven-plugin</artifactId>
<version>3.10.0.2594</version>
</plugin>
mvn sonar:sonar \
-Dsonar.projectKey=project \
-Dsonar.host.url=https://sonarcloud.io \
-Dsonar.token=$SONAR_TOKEN
Key Metrics
| Metric | Description | Good Value |
|---|
| Bugs | Reliability issues | 0 |
| Vulnerabilities | Security issues | 0 |
| Code Smells | Maintainability issues | Minimize |
| Coverage | Test coverage % | > 80% |
| Duplications | Duplicated code % | < 3% |
| Cognitive Complexity | Code understandability | < 15/function |
Language-Specific Rules
Excluding Files
# sonar-project.properties
sonar.exclusions=**/node_modules/**,**/dist/**,**/*.test.ts
sonar.coverage.exclusions=**/tests/**,**/__mocks__/**
sonar.cpd.exclusions=**/generated/**
API Examples
# Get project status
curl "https://sonarcloud.io/api/qualitygates/project_status?projectKey=KEY" \
-H "Authorization: Bearer $SONAR_TOKEN"
# Get issues
curl "https://sonarcloud.io/api/issues/search?componentKeys=KEY&types=BUG" \
-H "Authorization: Bearer $SONAR_TOKEN"
# Get metrics
curl "https://sonarcloud.io/api/measures/component?component=KEY&metricKeys=coverage,bugs,vulnerabilities" \
-H "Authorization: Bearer $SONAR_TOKEN"
Anti-Patterns
| Anti-Pattern | Why It's Bad | Correct Approach |
|---|
| No quality gate on PRs | Merging bad code | Enable PR decoration, block on failure |
| Excluding all tests from coverage | Inflated coverage numbers | Only exclude test utilities |
| Ignoring code smells | Technical debt accumulates | Fix or justify with comments |
| No coverage reporting | Can't track quality trends | Configure coverage reports in CI |
| Using default quality gate | Too lenient for most projects | Create custom stricter gate |
| Not reviewing Security Hotspots | Potential vulnerabilities missed | Review all hotspots before release |
Quick Troubleshooting
| Issue | Likely Cause | Solution |
|---|
| Quality gate failed unexpectedly | New code coverage < 80% | Add tests or adjust coverage target |
| Analysis not running | Missing SONAR_TOKEN | Add token to CI secrets |
| Coverage always 0% | Wrong report path | Check sonar.javascript.lcov.reportPaths |
| Duplicated code false positives | Boilerplate code | Add to sonar.cpd.exclusions |
| Too many issues reported | First scan on legacy code | Use "New Code" focus, fix incrementally |
| PR decoration not working | Missing GitHub App integration | Configure SonarCloud GitHub App |
Related Skills
