Welcome to the SonarQube documentation!

SonarQube® is an automatic code review tool to detect bugs, vulnerabilities, and code smells in your code. It can integrate with your existing workflow to enable continuous code inspection across your project branches and pull requests.

If you want to try out SonarQube, check out the Try out SonarQube page for instructions on installing a local instance and analyzing a project.

If you're ready to set up a production instance, check out the Install the Server documentation.

SonarQube IntelliJ Community Plugin The main goal of this plugin is to show SonarQube issues directly within your IntelliJ IDE. Currently the plugin is build to work in IntelliJ IDEA, RubyMine, WebStorm, PhpStorm, PyCharm, AppCode and Android Studio with any programming language you can analyze in SonarQube. Two tasks are covered by the plugin. In this section, we setup our IntelliJ IDEA workspace to integrate with our SonarCloud server so that we can use a centralized quality profile.

Otherwise, you can also find an overview and common scenarios below or navigate through and search the full documentation in the left pane.

Overview

In a typical development process:

1. Developers develop and merge code in an IDE (preferably using SonarLint to receive immediate feedback in the editor) and check-in their code to their ALM.
2. An organization’s continuous integration (CI) tool checks out, builds, and runs unit tests, and an integrated SonarQube scanner analyzes the results.
3. The scanner posts the results to the SonarQube server which provides feedback to developers through the SonarQube interface, email, in-IDE notifications (through SonarLint), and decoration on pull or merge requests (when using Developer Edition and above).

Installing, monitoring, and upgrading

See the installing and upgrading pages for setting up your production instance.

Connect Sonarlint To Sonarqube

When your instance is up and running, see the Monitoring documentation for information on keeping your instance running smoothly.

If you're using SonarQube Data Center Edition, see the Configure & Operate a Cluster documentation for more information on running your instance as a cluster. Using wordpress for business website.

Setting up analysis

Analyzing your code starts with installing and configuring a SonarQube scanner. The scanner can either run on your build or as part of your continuous integration (CI) pipeline performing a scan whenever your build process is triggered. For more information, see Analyzing Source Code.

Analyzing branches

Starting in Developer Edition, you can analyze your branches in SonarQube, and ensure that your code quality is consistent all the way down to the branch level in your projects. For more information, see Branch Analysis.

Analyzing pull requests

Starting in Developer Edition, you can integrate SonarQube to be part of your pull or merge request process. Issuing a pull request can trigger a branch analysis and add pull request decoration to see your branch analysis directly in your ALM's interface in addition to the SonarQube interface. For more information, see the Pull Request Analysis Overview.

Writing Clean and Safe Code

SonarQube gives you the tools you need to write clean and safe code:

• SonarLint – SonarLint is a companion product that works in your editor giving immediate feedback so you can catch and fix issues before they get to the repository.
• Quality Gate – The Quality Gate lets you know if your project is ready for production.
• Clean as You Code – Clean as You Code is an approach to code quality that eliminates a lot of the challenges that come with traditional approaches. As a developer, you focus on maintaining high standards and taking responsibility specifically in the New Code you're working on.
• Issues – SonarQube raises issues whenever a piece of your code breaks a coding rule, whether it's an error that will break your code (bug), a point in your code open to attack (vulnerability), or a maintainability issue (code smell).
• Security Hotspots – SonarQube highlights security-sensitive pieces of code that need to be reviewed. Upon review, you'll either find there is no threat or you need to apply a fix to secure the code.

Administering a Project

If you have the Create Projects permission (a global administrator can set permissions at Administration > Security > Global Permissions), you can create and administer projects. See Project Settings for general information on setting up projects.

A project is automatically added on the first analysis. However, you can provision projects (set up permissions, Quality Profiles, etc.) before running the first analysis. See Project Existence for more information on provisioning a project and handling provisioned projects.

You also want to make sure SonarQube's results are relevant. To do this you need to Narrowing the Focus or configure what to analyze for each project.

You can also set up Webhooks to notify external services when a project analysis is complete.

Administering an Instance

If you're a global administrator, you can set up authentication, administrator access, and authorization. See Security for more information.

You can also set up email notifications that developers can subscribe to that are sent at the end of each analysis.

When you run new analyses on your projects, some data is cleaned out of the database to save space and improve performance. See Housekeeping for information on what data is cleaned and how to change these settings.

Starting in Enterprise Edition, you can set up Portfolios to get a high-level overview on the releasability of a group of projects.

Staying Connected

Use the following links to get help and keep up with SonarQube:

SonarQube provides a plugin for IntelliJ (and Eclipse as well) which is a great tool to perform dev-box code analysis before committing or checking-in your changes. It gives the developers a chance to check and make sure they aren’t introducing any new defects or technical debt in the code they have added or modified. Here’s how to set up the plugin and get going.

Install SonarQube IntelliJ Plugin

• Launch IntelliJ and go to File -> Settings -> Plugins
• Search for ‘sonarqube’ and install the plugin

Setting up SonarQube plugin

• In IntelliJ go to File -> Settings -> Other Settings -> SonarQube
• Add details about the sonar server here. The plugin will use this to download the quality profile/analyzers etc.
• This plugin executes the analysis in preview mode where no data is pushed to the server.

Associate your IntelliJ project with Sonar project

• Right click on the project in IntelliJ and select 'Associate with SonarQube…'
• Search for the sonar project and select it

Running the analysis

• Make your code changes
• Right click on the project and select Analyze -> Run Inspection by Name…

• In the search box type 'Sonarqube' and select 'SonarQube Issue' from the result list
• In the 'Inspection Scope' dialog, select Custom Scope and set its value to Changed Files. This will ensure that the analysis is run on the files modified by you.

Idea Sonarqube

• The plugin will run the preview analysis and display the results in the inspection tab. The inspection shows issues in two files which were modified before the analysis.