SonarQube is an open-source platform for static code analysis, used to verify the technical quality of the source code. The development is managed by sonarsource (Tool website: sonarqube.org). The tool was released in 2007 and was called “Sonar” until the name was changed in 2013.

Homepage: https://www.sonarqube.org/

Doc: https://docs.sonarqube.org/latest/analysis/gitlab-integration/

1. Create Access Token in Gitlab in the Group or Project
   1. Token name: SonarQube
   2. Scopes: api
   3. Expiration date: empty = no
   4. Role: Reporter

Save the group access token

1. Import GitLab Project into SonarQube
   1. Add Projekt
   2. Enter group access token
2. Select Project you want to add
3. Choose “With GitLab CI” for analyze your repository
4. Project key: Other
5. file: .sonar-project.properties
   • In root dir of the project.
   • Filename: .sonar-project.properties
   • Content:

     sonar.projectKey=tests_firstgit_AYAi0enkA
     sonar.qualitygate.wait=true
     sonar.python.version=2

6. Add two vars to Project: Settings→ CI/CD → Variables
   1. key: SONAR_TOKEN
      1. Value: generate token in SonarQube Webinterface
      2. uncheck “Protect Variable”
      3. CHECK “Mask Variable”
   2. key: SONAR_HOST_URL
      1. Value: https://sq.schnuerle.com:9999
      2. Uncheck both: Protect Variable / Mask Variable

1. add sonarqube job in .gitlab-ci.yml

   1. stages:
       - sonarqube
       
       
      sonarqube_check_job:
        only:
          refs:
            - tags
          variables:
            - $CI_COMMIT_TAG =~ /^[Cc]heck_source-.*$/                                                         # commit tag starts job
        image: 
          name: sonarsource/sonar-scanner-cli:latest
          entrypoint: [""]
        tags:
          - sonarqube-runner
        stage: sonarqube
        variables:
          SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"                                                          # Defines the location of the analysis task cache
          GIT_DEPTH: "0"                                                                                       # Tells git to fetch all the branches of the project, required by the analysis task
        cache:
          key: "${CI_JOB_NAME}"
          paths:
            - .sonar/cache
        script: 
          - sonar-scanner -Dsonar.qualitygate.wait=false -Dproject.settings=.sonar-project.properties          # -X = debug, only for tests if failed