Jenkins SonarQube build-wrapper build step?

SonarQube
, ,
1
  • which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)

Latest SonarQube 8.1-beta docker version for Developer edition
Jenkins LTS 2.190.3
SonarQube plugin 2.11

  • what are you trying to achieve:

We are migrating from Coverity to Sonarqube, for C/C++ analysis.
Jenkins Coverity plugin is providing great integration with Jenkins:

  • a global instance configuration
  • a tool global & per-node configuration to specify location of local analyzer (similar to build-wrapper + sonnar-scanner)
  • “build-step wrappers” that basically start the analyzer before actually calling either batch/shell to listen to everything happening during the Jenkins job. This is quite handy to enable analysis on Jenkins without impacting build script content. Projects can just use it as a replacement for “Execute using windows batch / Execute Shell” build steps

I’ve seen something similar for MSBuild, but are there such kind of integration for Sonarqube build-wrapper?

As a SonarQube & Jenkins user who needs to use build-wrapper to enable C/C++ analysis, i would expect to have a very similar feature than SonarScanner for MSBuild integration, maybe just one build step “SonarScanner for build-wrapper - Windows batch” (and “SonarScanner for build-wrapper - Execute shell”)

  1. allow to provide sonar configs, especially sonar.cfamily.build-wrapper-output
  2. providing the regular text box to store build script
  3. automatically starting build-wrapper (defined in global / node tool properties) --out-dir sonar.cfamily.build-wrapper-output " cmd /c call C:\Users\jenkins\AppData\Local\Temp\jenkins8160427382440937034.bat (which is a internal temporary jenkins file created automatically containing the full content of the build script text box)
2

Hi @scm_invn,

thank you for your feedback. You are right, build-wrapper integration is currently missing from jenkins plugin, I’ll take the feedback internally.

I am not sure what else you expect with your post, may I help you with something else other than taking the feedback?

3

Thanks @mpaladin, at least i did not missed an important piece of information :wink:

I see https://jira.sonarsource.com/browse/MMF-220, which is closed as not being a short-term priority for dev team.
Does it mean we have for now to cope with existing non-integration and include build-wrapper into build scripts, or we can expect soon some updates on the topic?

We could try contributing to the plugin, but at a first glance this is not an easy change to implement…

4

Hi @scm_invn,

this was a long time ago and may get re-evaluated at some point.

Integration is not as complicated as it sound, it correspond to a curl + unzip call, is it really something blocker for you?

5

Hi there
not a blocker, just not as transparent as it used to be with our previous SCA tool.
In the end, build-wrapper will be added to each build machine path, so no need for curl/unzip stuff.
Thanks again for your inputs

1 Like
6

Hi @scm_invn,

ok, thank you for the update.