Sonar Scanner for NPM Internal vs External

billy-briggs-dev · April 25, 2025, 2:10pm

github.com/SonarSource/sonar-scanner-npm

src/request.ts

master


      
                }),
              };
            }
          }
          
          export function fetch<T = unknown>(config: AxiosRequestConfig) {
            if (!_axiosInstances) {
              throw new Error('Axios instance is not initialized');
            }
            // Use external instance for absolute URLs
            if (!config.url?.startsWith('/')) {
              log(LogLevel.DEBUG, `Not using axios instance for ${config.url}`);
              return _axiosInstances.external.request<T>(config);
            }
            return _axiosInstances.internal.request<T>(config);
          }
          
          export async function download(url: string, destPath: string, overrides?: AxiosRequestConfig) {
            log(LogLevel.DEBUG, `Downloading ${url} to ${destPath}`);
          
            const response = await fetch<NodeJS.ReadStream>({

This logic for assuming that a url is internal based off of the start of the url string is not correct. For instance at my company we have urls defined like so:

“sca.mycomp.com/sonar”
“ci.mycomp.com/jenkins”

Where we have a use case where we are connecting to our internal sonar from our internal jenkins instance, and we expect to be able to provide a SONAR_TOKEN to do so. There is no issue using the general purpose sonar-scanner for this use case. However when we use the sonar/scan npm dependency we run into issues with the above mentioned code.

We would prefer a bugfix for this to enable our use case; as the Sonar NPM package provides useful capturing of package details automatically.

victor.diez · April 29, 2025, 10:46am

Hello @billy-briggs-dev,

what is the problem you are facing exactly when using those URLs? Can you please share what is the full command line you are using and what is your expected behaviour vs what is actually happening? internal vs external is mostly to know if we are facing a sonar instance or not.

Cheers,
Victor

Topic		Replies	Views
Scan JavaScript & TypeScript with npm @sonar/scan! Sonar Updates javascript , typescript , scanner	0	910	March 20, 2025
Best SonarQube scanner for npm Angular projects SonarQube Server / Community Build scanner	2	4916	September 8, 2021
Running sonarqube scan for Next.Js Typescript codebase SonarQube Server / Community Build sonarqube	1	1052	October 25, 2023
Global Typescript is used instead of local SonarQube Server / Community Build typescript	7	1771	June 29, 2020
Can't use Java17 using Scanner for NPM SonarQube Cloud java11	7	1400	February 6, 2024

Sonar Scanner for NPM Internal vs External

Related topics