How to scan a local project?

SonarQube Server / Community Build
1
  • SonarQube Community Build
  • Docker
  • Scan local repo (in VSCode)
  • Create new project in SonarQube, Connect from VS Code to that project

This is driving me nuts lol.

I just want to scan a local project with sonarqube. I do not want GitHub, and whatever else online/cloud eyes on this.
I use a self-hosted SonarQube Community server (updated today)
I already have an existing connection from my VSCode to it because I do analyze other projects (which are on github) with it too.
So I went into my sonarqube instance, added a project (call it My Project) and then in VS Code I opened my local project, I went to SonarQube setup section, I chose my existing connection, I added a project and selected the one I just created in SonbarQube

At the bottom of visual code it says “scanning 11 files” so I thought wow, fast and cool.

yet, zero issues found, so, no, this can’t be: I am not writing pixel perfect code.
Going back to SonarQube I see I am supposed to install some pip install pysonar and then run a terminal command
```

pysonar \
  --sonar-host-url=https://my-host.com \
  --sonar-token=my_token \
  --sonar-project-key=My Project
```

??? I am confused.
Why can I not analyze from the comfort of the VS UI as I do with all other projects (which have a Github instance)?
Why does it say “scanning 11 files” but clearly doesn’t?

How do I actually use SonarQube locally without going an installing new packages for each new project (which might have different languages), and avoid use terminal, since I have the VisuaCode extension of SonarQube?

2

… I cannot even connect it with GitHub since it does not allow me to add more than one GitHub org to the sonarqube instance?!

I am sorry but either the tool is extremely limited and basically useless for anything larger than a hobby instance or… I miss something

I was using sonar cloud before, and there I could at least use more than one org from GitHub?
That was at no add-on cost I believe, why would I not be allowed to do this on the self hosted instance?

3

Hi,

You’ve conflated two different things. You can use SonarQube for IDE in VS Code to check your coding as you type. Doing so will not make the project show up in SonarQube Community Build.

For that, you’ll need to run a (yes) command-line analysis. Don’t forget to include, at minimum, the mandatory analysis parameters.

 
HTH,
Ann

4

This seems weird to me.

  1. How do I actually add more than just one GH org to the SonarCloud instance (selfhosted)?
  2. How do I actually add projects to it that are in my personal GH?
  3. Why is it different if I scan a project with/in VS Code, vs the terminal? In the bed, both tools use my selfhosted SonarCloud instance, right?

Also note my report, I do not think I “conflate” things:

At the bottom of visual code it says “scanning 11 files” so I thought wow, fast and cool.

yet, zero issues found, so, no, this can’t be: I am not writing pixel perfect code.

It did connect, and it did scan. If it wouldn’t use my SonarCloud instance… then I just do not understand what it actually does. Are you saying the VS Code extension scans the code without being able to be forced to connect to the online instance? Why then can the terminal do it? In the end it uses the exact same source tool, correct?

5

Hi,

I don’t understand any part of this question. Particularly in light of your OP, which I had to refresh myself on since it’s been 4 months:

SonarQube Cloud runs in the cloud. It is not your self-hosted instance. That would be SonarQube Community.

Beyond that we try to keep it to one topic per thread. Otherwise it can get messy, fast. If you’d like to pursue this and question 2, please create new threads for them.

No, actually. If you connect SonarQube for VS Code to your local SonarQube Community Build instance, you apply in-IDE the same rules that are applied at the server. You may also be able to analyze more languages than you can with SonarQube for VS Code OOTB. The docs should help. But you are not running the same analysis in the same way. Full analysis covers all the files in your project. SonarQube for VS Code handles the files that you’re working on in the editor.

 
HTH,
Ann

6

Not proceeding here since there is a clear unwillingness to help users who are not paying, which at some level, is understandable.

No profit, no help - fair enough.

7

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.