- ALM used Bitbucket Cloud
- CI system used Bitbucket Cloud
- Scanner command used when applicable
image: mcr.microsoft.com/dotnet/sdk:8.0
clone:
depth: full # SonarCloud scanner needs the full history to assign issues properly
definitions:
caches:
sonar: ~/.sonar/cache # Caching SonarCloud artifacts will speed up your build
steps:
- step: &build-test-sonarcloud
name: Build, analyze on SonarCloud
caches:
- dotnetcore
- sonar
script:
- apt-get update && apt-get install --yes --force-yes openjdk-17-jre
- dotnet tool install --global dotnet-sonarscanner
- export PATH="$PATH:/root/.dotnet/tools"
- dotnet sonarscanner begin /o:"$SONAR_ORG " /k:"$PROJECT_KEY" /d:"sonar.login=${SONAR_TOKEN}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.dotcover.reportsPaths="**/*.dotcover"
- dotnet build
- dotnet sonarscanner end /d:"sonar.login=${SONAR_TOKEN}"
- step: &build-test-sonarcloud-quality-gate
name: Build, analyze and quality gate check on SonarCloud
caches:
- dotnetcore
- sonar
script:
- apt-get update && apt-get install --yes --force-yes openjdk-17-jre
- dotnet tool install --global dotnet-sonarscanner
- export PATH="$PATH:/root/.dotnet/tools"
- dotnet sonarscanner /d:"sonar.qualitygate.wait=true" begin /o:"$SONAR_ORG " /k:"$PROJECT_KEY" /d:"sonar.login=${SONAR_TOKEN}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.dotcover.reportsPaths="**/*.dotcover"
- dotnet build
- dotnet sonarscanner end /d:"sonar.login=${SONAR_TOKEN}"
pipelines:
branches:
master:
- step: *build-test-sonarcloud
pull-requests:
'**':
- step: *build-test-sonarcloud-quality-gate
- Languages of the repository: C#
- Only if the SonarCloud project is public, the URL: not public
Following is the screenshot from the PR raised in bitbucket which has passwords:
However, the sonarcloud scan of that particular PR didn’t detect these passwords.
I can share the scan log file as private message.
