Sonarqube API to get the count of Bugs, vulnerability, Debt, Code smell and Code coverage on Version 6.7.7 (build 38951)

SonarQube
,
1

Dear Team,

Need Sonarqube API details to get the only count of Bugs, vulnerability, Debt, Code smell and Code coverage on Version 6.7.7 (build 38951)

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
    Sonarqube Server : Version 6.7.7 (build 38951)
    Scanner : sonar-scanner-cli-2.9.0.670.jar

  • what are you trying to achieve
    We are using jenkins to complete the Continuous Integration where Sonar Analysis is our Code Quality Test Stage and we want to send the count of Bugs, vulnerability, Debt, Code smell and Code coverage to respective team members on mail via Jenkins.

  • what have you tried so far to achieve this
    We are not able to find the API on sonarqube Version 6.7.7 to get these details.

Thanks,
Abhishek Chordia

2

Hi Abhishek,

Welcome to the community!

To do this you can use the issues search web service. You’ll find a link to the on-board docs in the footer of the page.

However, I think you’ll be better served by taking a look at webhooks instead. With webhooks, you can have Jenkins notified automatically once the analysis report is processed with the status of the Quality Gate and the state of the metrics being tested in your Quality Gate.

Either way, you’ll have to wait for analysis report processing to complete. If you try to manually pull the issue counts you’ll have to poll SonarQube for task completion, keeping a Jenkins executor tied up the whole time, versus being able to suspend the pipeline until Jenkins is notified by SonarQube.

The other thing to consider here is that developers are auto-assigned any new issues they’ve created. They can subscribe to new issue notifications (you can’t do this for them, you’ll need to practice the gentle art of persuasion here) so the need for issue counts in Jenkins notifications should go away. Additionally, it’s really not raw issue totals you should be concerned with. (Why? Because if that’s the focus then I can kill 2 old, easy issues and add 1 new really bad one and still be “okay” according to what you’re measuring.) Instead you should be looking at new issues and what’s happening in New Code. SonarQube’s default Quality Gate is focused exclusively “on New Code”, so by using a webhook to get the Quality Gate status and Quality Gate metric values, you automatically benefit from that.

I know there’s a lot here to unpack. I’m happy to answer followups.

 
Ann