Configure SonarQube analysis in CI - #9
Draft
trly wants to merge 1 commit into
Draft
Conversation
trly
force-pushed
the
sonarqube-analysis-config-e4130c36-a1ca-4c80-b9be-4ebebc4b7547
branch
from
August 7, 2026 19:30
159bb95 to
b057abc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Configures SonarQube static analysis for this project, based on the setup in deprecated-java-api-demo-1.
Gradle projects get the
org.sonarqubeplugin and asonarconfiguration block; Maven projects get thesonar-maven-pluginand Sonar properties inpom.xmlplus a dedicated analysis workflow on JDK 17. Both record the project name and the repository's SCM URL. Repositories that already had part of this setup only receive the difference.Before analysis will run, set a
SONAR_PROJECT_KEYrepository variable (Settings → Secrets and variables → Actions → Variables) to the key SonarQube assigned this project when it was imported through the GitHub App — for examplesourcegraph-testing_<repo>_<uuid>, visible in the project's URL as?id=<key>. The key is not hardcoded because the generated suffix cannot be derived from the repository name, and it is not left to default because the scanner would otherwise invent a key from the Gradle project name and create a second, unbound project. The analysis step is skipped while the variable is unset.Analysis runs as its own step marked
continue-on-error, so an unsuccessful scan never fails the build. It also needs theSONAR_TOKENsecret and, for self-hosted SonarQube, aSONAR_HOST_URLsecret including thehttps://scheme.Created by Sourcegraph agentic batch change.