Seeking general guidance for developing a SonarQube SCA plugin

SonarQube Server / Community Build Plugin Development
1

Hi all,

My team and I are developing a Software Composition Analysis (SCA) plugin for SonarQube. We have already released a few versions and we currently support Java, NodeJS, .NET and C/C++ codebases and have plans to support further more languages/technologies.

We are fairly new in this territory and we are keen to learn more, hence why we felt like asking the community for general directions to follow in SQ plugin development.

Of course we know about this dedicated section of the forum and we are aware of:

Anything missing from the list :slight_smile: ? Are there more resources you’d suggest?

We think that this is a minor issue but, for instance, we’ve noticed that at boot when SQ is deploying plugins our appears to be missing an ID. Maybe it’s a build ID but we haven’t seen it documented anywhere and we don’t know precisely why ours is missing.

2024.04.17 15:06:17 INFO  web[][o.s.s.p.ServerPluginManager] Deploy Java Code Quality and Security / 7.16.0.30901 / 4b1436558dfd5fc00c8d9aae8bb0364ba122c73e
2024.04.17 15:06:17 INFO  web[][o.s.s.p.ServerPluginManager] Deploy JavaScript/TypeScript/CSS Code Quality and Security / 9.13.0.20537 / 68ff7657415044b86033814795ed95fc1f1558f1
2024.04.17 15:06:17 INFO  web[][o.s.s.p.ServerPluginManager] Deploy Kotlin Code Quality and Security / 2.12.0.1956 / a6df1ae252bd62d63f8673c28f87ad14258a7904
2024.04.17 15:06:17 INFO  web[][o.s.s.p.ServerPluginManager] Deploy Meterian / 1.4.7 / null
2024.04.17 15:06:17 INFO  web[][o.s.s.p.ServerPluginManager] Deploy PHP Code Quality and Security / 3.27.1.9352 / 3ddc5a03e1a7e3729d41e7c1a30a37d5715958c7
2024.04.17 15:06:17 INFO  web[][o.s.s.p.ServerPluginManager] Deploy Python Code Quality and Security / 3.24.1.11916 / cc8f4fa745eb33d31c3869bdfdfd45514e67c1fe
2

In regards to the plugin id, why don’t you check the jar of the other public plugins? Maybe it’s something that should be present in the MANIFEST.MF file of your plugin. Possibly the ‘Implementation-Version’ field?

If you are using Maven, to generate for example the ‘Implementation-Version’ value, you could use this entry in the pom.xml:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-jar-plugin</artifactId>
    <version>VERSION</version>
    <configuration>
        <archive>
            <manifest>
                <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
            </manifest>
            <manifestEntries>
                <Implementation-Version>${project.version}-${git.commit.id}</Implementation-Version>
            </manifestEntries>
        </archive>
    </configuration>
</plugin>
2 Likes
3

Hi John, that’s a good idea! Will look into it thanks!