How to do Sonarqube analysis for lua code base

SonarQube Server / Community Build Plugin Development
1

I want to know that is there any static analysis tool for analysing lua code base . If yes then how can we integrate with sonar scanner to see the report on sonarqube server.
I found one tool luacheck . But i am not aware how to integrate with sonarqube. .

In nutshell I want my lua source code to be analyzed by sonar scanner so that i can scan and see my results or report on sonarqube server

3

Hi @rudra,

Welcome to the Community :smiley:

There’s a Community-based Lua plugin over here that may do what you’re after, although it looks like it’s somewhat out of date and it may not be compatible with recent SonarQube versions. Failing that, you can convert issues from other tools into SonarQube’s Generic Issue format and import them as part of a standard code scan.

Regards,

Cameron.

4

Hi Cameron , thanks for quick reply . I found one static analysis tool luacheck .
I executed this command “luacheck <file.lua or directory >” , it is showing me the errors if any error is present in code . I redirected the output into some .txt format like luareport.txt . But while running sonar scanner this report is not readable . Hence i could not see any bug in sonarqube server GUI .
Also the sonar plugin which i have used on my Sonarqubeserver side has only capability of detecting code smells, not bugs and vulnerability. So could you suggest me any lua plugin which detects bugs too.

5

Hi @rudra,

I doubt that the luacheck output is compatible with direct import. SonarQube recognises our XML-based Generic Issues format so you’ll need to convert the luacheck output format.

Which plugin do you have installed?

Regards,

Cameron.

6

Hi @Cameron , I have installed this plugin sonar-lua-plugin-1.0.jar. which shows only code smells not bugs and Vulnerability.

Regards,
Rudra

7

@Cameron, how can i convert luacheck output to xml format .
ex: luacheck myfile.lua > luareport.xml , is that like that i need to convert simply.
and then how to tell sonar scanner to read this report file from sonar properties file

8

Hi @rudra,

SonarQube provides the XML input format; it’s up to you to convert data from other tools to that format. Unfortunately I have no information on the output format from luacheck so I can’t even give any general advice.

Regards,

Cameron.