Can Jenkins upload SonarQube analysis reports to AWS S3 without using cURL?

Suggest new features
1

Hi SonarQube Community,

We have an existing Jenkins CI/CD pipeline for microservices. Currently, Jenkins runs SonarQube analysis after the code is pushed, and we want to introduce a new requirement that.

After the SonarQube analysis is completed, we want to upload the complete analysis results to a private AWS S3 bucket directly from Jenkins.

The report should contain detailed information such as:

  • Bugs and vulnerabilities

  • Security hotspots

  • Code smells

  • Issues and their severity

  • Quality Gate results

  • Other relevant SonarQube analysis details

We are using SonarQube for code analysis and Jenkins for CI/CD.

Questions:

  • Does SonarQube or sonar scanner support exporting complete analysis reports, including issues and security hotspots, directly to AWS S3 after an analysis?

  • Is there a supported integration or plugin for this purpose?

  • Can this be achieved without using cURL or manually invoking SonarQube Web APIs?

Any guidance or recommended approach would be appreciated.

Thank you!

2

Hey @KUSHAL, the Scanner doesn’t support such a thing, however, your SonarQube Server/Cloud might, depending on the product/edition you’re on. You haven’t told us which specifically, so I’ll summarize for everything:

  • On SonarQube Server Enterprise Edition, SonarQube Server Data Center Edition and SonarQube Cloud Enterprise Plan: you can generate project PDF reports. This is normally done via UI, but you could just script your Jenkins pipeline to hit the corresponding API endpoint, receive the file and then upload it.
  • On SonarQube Server Community Edition, SonarQube Server Developer Edition, SonarQube Cloud Free Plan and SonarQube Cloud Team Plan: this feature is not available, so you would have to somehow hit API endpoints that return project metrics and build a report yourself.
3

Hi Andrés,

Thank you for the clarification.

We are currently using SonarQube Server Community Edition.

We would like the report to contain information similar to the native SonarQube PDF report, including:

  • Bugs

  • Vulnerabilities

  • Security Hotspots

  • Code Smells

  • Issues and their severity

  • Code Coverage

  • Duplications

  • Quality Gate status

  • Other relevant analysis metrics

Since we are using Community Edition, could you please provide the official SonarQube Web API endpoint(s) that can retrieve this information from a completed analysis?

Specifically:

  1. Is there a single API endpoint that provides all the information required for a complete project report?

  2. If not, which APIs should we use to retrieve Issues, Security Hotspots, Coverage, Duplications, Quality Gate status, and other project metrics?

Could you please point us to the recommended APIs and documentation for this use case?

Thank you!

4

Hey @KUSHAL, you can find a reference of the Web API endpoints under <your_instance_url>/web_api and <your_instance_url>/web_api_v2. You are going to have to a fair bit of scripting to put it all together, as essentially you would be recreating what our paid editions (SonarQube Server Enterprise Edition, etc) already implement in their reporting features.

5

Can you please share sample pdf or the data the Enterprise Edition generates as a refernece

6

Hi @andres one more thing, i went to the apis screen there are multiple apis can you share or list the apis which gives the apis for the scan results if possible.

Thanks

7

Hey @KUSHAL, you can read more about the Enterprise reports in our documentation, check out this paragraph where we detail the contents.

As for which API endpoints to use, the main one that you can use to retrieve metrics for a given project is GET /api/measures/component?component=<projectKey>&metricKeys=<metric1,metric2>. You might also be interested in GET /api/metrics/search to discover valid metric keys, types… before querying them.

I encourage you to try it out and to dive into the API reference (or to ask your favorite AI agent to figure it out). However, I hope you will understand that at the end of the day, you are a user of the free version trying to recreate a paid feature, so I’m not going to invest a lot of effort in guiding you through it.