Sonar lint on Github PR

SonarQube Server / Community Build
1

We need to set up sonar linting for java files during PR using github can you please help

2

Hi,

This is a pretty big question. Do you have SonarQube Server installed? Or are you using SonarQube Cloud?

What have you tried so far?

 
Ann

3

we will isntall sonarQube on fly using git hub actions and have sonar lint scans

4

Hi,

This is two different things. SonarQube for IDE is a plugin that lives in your IDE and analyzes as you type.

Anything related to GitHub Actions, implies that you’re analyzing in your CI/CD pipeline and posting analysis results to either SonarQube Cloud or a self-hosted instance.

 
Ann

5

Thanks ganncamp for your inputs,

Is there a way to lint Java files during pr raised for changed files using SonarQube?

we need to implement this in Github Actions.

6

Hi,

Are you using SonarQube Server or SonarQube Community Build? Only Server supports PR analysis.

 
HTH,
Ann

7

We are not using any SonarQube server, if there is a linting option for java changed files, we will setup github actions in runner to install sonarquebe and lint the file and show results. Is this possible?

8

Hi,

For PR analysis, you’ll need to use either SonarQube Server Developer Edition($) (self-hosted) or SonarQube Cloud. There is no stand-alone option for PR analysis.

 
HTH,
Ann

9

Thanks , if we use SonarQube server Developer edition can we use that java lint ?

10

Hi,

Here’s the list of 3rd-party reports we import natively. If your tool isn’t in the list, then you can look at converting the output to our Generic Issues format.

 
HTH,
Ann

11

Hi Ann thanks for the inputs.

We need to run Sonar analysis for code smells, vulnerabilities, and potential bugs only on the Java files that have changed in a PR. Running a full scan takes more than 1 hour and 30 minutes due to the large codebase, which makes it impractical to wait for each PR.

Is it possible to limit the scan to only the Java files changed during the PR?

12

Hi,

That’s what PR analysis does. You’ve previously asked about Developer Edition. Using it would get you PR analysis. You’ll need to analyze the base branch first for this to work tho.

 
HTH,
Ann

13

Thanks Ann, Can you please help us on steps for doing this process.

14

Hi,

The docs should get you started.

 
Ann