- Version of SonarQube Dev : v10.6 (92116)
- Installed via zip
- I’m trying to do a first analysis of our code from a branch on self-hosted Gitlab
Hi there, I want to evaluate SonarQube for our current Gitlab repos (C/C++ code).
So far I’ve managed to implement the pipeline provided by SonarQube Import Project function.
We want to have a full report of our code base from a SonarQube Test-Branch, because we don’t want to merge it into main/develop yet (for obvious reasons). Is there a parameter, switch etc. that forces SonarQube into a complete scan rather using iterative as it uses per default? I understand why this feature is awesome, but we want to evaluate SonarQube and need a full analysis of our software for that.
Our current gitlab-ci
image: git.own-repo.de:5050/xxx/dockerimages/own_image:ev
variables:
SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar" # Defines the location of the analysis task cache
GIT_DEPTH: "0" # Tells git to fetch all the branches of the project, required by the analysis task
stages:
- get-binaries
- build
- sonarqube-check
- sonarqube-vulnerability-report
get-binaries:
stage: get-binaries
cache:
policy: push
key: "${CI_COMMIT_SHORT_SHA}"
paths:
- sonar-scanner/
script:
- curl -sSLo ./sonar-scanner.zip 'https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-6.0.0.4432-linux.zip'
- unzip -o sonar-scanner.zip
- mv sonar-scanner-6.0.0.4432-linux sonar-scanner
rules:
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $CI_COMMIT_BRANCH == 'master'
- if: $CI_COMMIT_BRANCH == 'main'
- if: $CI_COMMIT_BRANCH == 'develop'
build:
stage: build
dependencies:
- get-binaries
script:
- sudo apt-get update && sudo apt-get install -y openssh-client
- eval $(ssh-agent -s)
- mkdir -p ~/.ssh
- chmod 700 ~/.ssh
- echo "$CI_SERVER_GITLAB_PRIV_KEY" | tr -d '\r' | ssh-add -
- ssh-keyscan git.own-repo.de >> ~/.ssh/known_hosts
- chmod 644 ~/.ssh/known_hosts
- sudo mkdir /deploy && sudo chown -R ciserver:ciserver /deploy
- echo "[credential \"https://git.own-repo.de\"]" > /home/ciserver/.gitconfig
- echo " username = ciserver" >> /home/ciserver/.gitconfig
- echo " helper = \"!f() { echo username=ciserver; echo password=$CI_SERVER_GITLAB_APIKEY; }; f\"" >> /home/ciserver/.gitconfig
- cmake --preset ConfigRelease
- cmake --build --preset BuildRelease --parallel
- ctest --preset "Test Release all"
cache:
policy: pull-push
key: "${CI_COMMIT_SHORT_SHA}"
paths:
- sonar-scanner/
sonarqube-check:
stage: sonarqube-check
dependencies:
- get-binaries
- build
cache:
policy: pull
key: "${CI_COMMIT_SHORT_SHA}"
paths:
- sonar-scanner/
script: sonar-scanner/bin/sonar-scanner -X --define sonar.host.url="${SONAR_HOST_URL}"
allow_failure: true
rules:
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $CI_COMMIT_BRANCH == 'master'
- if: $CI_COMMIT_BRANCH == 'main'
- if: $CI_COMMIT_BRANCH == 'develop'
sonarqube-vulnerability-report:
stage: sonarqube-vulnerability-report
script:
- 'curl -u "${SONAR_TOKEN}:" "${SONAR_HOST_URL}/api/issues/gitlab_sast_export?projectKey=xxx_developer_xxx-template_6af7cbea-1d1f-4d80-9a76-be5782caa93c&branch=${CI_COMMIT_BRANCH}&pullRequest=${CI_MERGE_REQUEST_IID}" -o gl-sast-sonar-report.json'
allow_failure: true
rules:
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $CI_COMMIT_BRANCH == 'master'
- if: $CI_COMMIT_BRANCH == 'main'
- if: $CI_COMMIT_BRANCH == 'develop'
artifacts:
expire_in: 1 day
reports:
sast: gl-sast-sonar-report.json
