Validate Mule application code in SonarQube Cloud

We are using Azure Devops with SonarQube Cloud, and we have a new project using Mulesoft and we need to validate the Mule application code. From the research i have done so far I cannot find anything that will help us in SonarQube Cloud, as everything points us towards the Mule SonarQube Plugin which is not available in the SonarQube Cloud we use.

From my current understanding the only way we can validate the Mule application code, would be to setup a separate SonarQube server and all the overheads that would require to be able to do this.

Is there anyone in the sonarsource community who could confirm or deny this, and if so give us some ideas on how we can achieve it.

Thx

Welcome back to the community.

SonarQube Cloud doesn’t have a MuleSoft/Mule language analyzer. It can analyze Java and generic XML in a Mule project, but Mule-specific rules, DataWeave (.dwl), and RAML aren’t natively supported.

I can confirm that it isn’t possible to install third-party plugins on SonarQube Cloud.

It is possible to import external issues into SonarQube cloud at scan time; so, if you find (or create) a tool that can analyze mule applications and output a report in SARIF format, for example, you can tell SonarScanner to import that report by adding the report’s file path to the sonar.sarifReportPaths analysis property.

Thanks for the reply, you do not mention using the Mule SonarQube plugin in a SonarQube server setup as a possible option. Do I assume that would not work either ?

Regards,

Andrew

Good news! We just released support for MuleSoft on SonarQube Cloud. You can find the docs here: MuleSoft | SonarQube Cloud | Sonar Documentation.

you do not mention using the Mule SonarQube plugin in a SonarQube server setup as a possible option. Do I assume that would not work either

Until a native MuleSoft plugin is released with SonarQube Server, you could explore using a third-party plugin like mulesoft-catalyst/mule-sonarqube-plugin.

Note: Third-party plugins are not provided by Sonar; therefore, you install them at your own risk.

Thanks for the response,
we are trying to make sense of the MuleSoft | SonarQube Cloud | Sonar Documentation . If we try to assign a Quality Profile to the Mule Project in SonarQube/SonarCloud, the Language option for ‘MuleSoft’ does not appear. It only seems to appear in
//General Settings/Languages. The quality profile we see being used in the ADO logs is ‘Quality profile for xml: Sonar way’. How do we put this together ?

I am posting an update on what we have done so far and our findings. In the hope that someone from Sonarsouce will be able to use this information.

Azure DevOps Repos

Using Azure DevOps yml pipelines.

Task name for this case is the Maven@4

Pipeline: All of the necessary taks to get ready for the build then we do SonarCloudPrepare@4 → Maven@4 (goals: ‘clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970:sonar’)

options: >

    -DskipTests=true 

    -Denv=${{ lower(parameters.muleEnvironment) }} 

    -Dmule.env=${{ lower(parameters.muleEnvironment) }} ${{ parameters.munitSAPConnectorProfile }} $(azureVaultSecretsforMunits) 

    -Dsonar.sources=src/main

    -Dsonar.tests=src/test/munit

    -Dsonar.inclusions=\*\*/\*.xml,\*\*/\*.dwl

    -Dsonar.verbose=true

    -Dsonar.projectKey=<orgName>\_ foo_bar

-> SonarCloudPublish@4

Project Structure
Dataweave files located under

src/main/resources/mappings/*.dwl

Example files

create-enquiry-request.dwl

ErrorHandlerUtils.dwl

set-workflow-headers.dwl

Sonar Scanner Configuration
-Dsonar.sources=src/main

-Dsonar.tests=src/test/munit

-Dsonar.inclusions=**/*.xml,**/*.dwl

-Dsonar.verbose=true

Scanner Context confirms
sonar.sources=/home/vsts/work/1/s/src/main

sonar.tests=/home/vsts/work/1/s/src/test/munit

sonar.dataweave.file.suffixes=dwl

No project level inclusions or exclusions are configured in SonarQube/Cloud

Successful Analysis

Verbose logging shows
Quality profile for dataweave: DataWeave

Sensor Deterministic Rule Engine for DataWeave [dre]

Starting analysis of 9 files with 25 rules

Sensor Deterministic Rule Engine for DataWeave [dre] (done)

Mule analysis is running
Sensor Deterministic Rule Engine for Mule [dre]

Starting analysis of 6 files with 41 rules

And XML analysis

Sensor XML Sensor [xml]

7 source files to be analyzed

7/7 source files have been analyzed

The scan completes successfully

ANALYSIS SUCCESSFUL

Questions we have
Although the logs clearly show the analysis was successful. The Sonarqube/Cloud UI for the project. Show it as passed, but no details or any information. Code → results are empty, Measures show nothing. Cannot browse to any files through the code view. Is this expected behaviour for the Mule/DataWeave DRE analyzers in SonarQube/Cloud ? or should we see something. Based on the logs, the analyzers appear to be functioning correctly. We’re now trying to understand whether the UI behaviour is expected or indicative of another issue. Also why in the Quality Profiles can you not Add MuleSoft as a language as it does not appear in the list), teams want to see what rules are being applied, as the logs clearly say
INFO] Sensor Deterministic Rule Engine for Mule [dre]

INFO] Detected mule-artifact.json.

INFO] Starting analysis of 6 files with 41 rules

Where are these rules coming from ?

Hello Andrew,

MuleSoft is a platform rather than a single programming language, so its analysis is split across two different artifact types:

  1. Mule application configuration, written in Mule XML
  2. Transformation logic, written in DataWeave

DataWeave is a programming language in its own right. Its rules are provided through the dedicated DataWeave language and quality profile.

Mule configuration files are XML documents with Mule-specific semantics. Their rules are exposed as XML rules, identifiable with the “mulesoft” tag, and are governed by the XML quality profile. Moreover, Mule configuration also benefits from the general-purpose XML rules.

This is why “MuleSoft” does not appear as a selectable language in the Quality Profiles page.

Does this address your questions? Please let me know if I can help further.

That behaviour is not expected. If files were successfully analyzed, they should be visible in the SonarQube UI.

Do you see any analysis warnings in the UI or in the scanner logs? If possible, please share the analysis logs so we can investigate further. Feel free to anonymize file paths and any sensitive information.

These are the anonymized logs, everything was succesful
[INFO] Apache Maven 3.9.16
[INFO] Java version: 17.0.20
[INFO] Linux amd64

[command]/usr/bin/mvn
-DskipTests=true
-Dsonar.sources=src/main
-Dsonar.tests=src/test/munit
-Dsonar.inclusions=/*.xml,/*.dwl
-Dsonar.verbose=true
-Dsonar.projectKey=<PROJECT_KEY>
clean verify
org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970:sonar

[INFO] Building <PROJECT_NAME> 1.0.3-SNAPSHOT

[INFO] — sonar:5.7.0.6970:sonar (default-cli) —

[INFO] Java 17.0.20 Eclipse Adoptium (64-bit)
[INFO] Linux amd64

[INFO] Communicating with SonarQube Cloud
[INFO] Starting SonarScanner Engine…
[INFO] Java 21.0.11 Eclipse Adoptium (64-bit)

[INFO] Found an active CI vendor: ‘Azure DevOps’

[INFO] Project key: <PROJECT_KEY>
[INFO] Base dir:
[INFO] Working dir: /target/sonar

[INFO] Detected project binding: BOUND

[INFO] Branch name: <FEATURE_BRANCH>

[INFO] 2 languages detected in 17 preprocessed files
[INFO] 8 files ignored because of inclusion/exclusion patterns

[INFO] Indexing files…
[INFO] 17 files indexed

[INFO] Quality profile for dataweave: DataWeave
[INFO] Quality profile for xml: Sonar way

[INFO] Sensor XML Sensor [xml]
[INFO] 7 source files to be analyzed
[INFO] 7/7 source files have been analyzed

[INFO] Sensor EnterpriseTextAndSecretsSensor [textenterprise]
[INFO] 17 source files to be analyzed for the text and secrets analysis
[INFO] 17/17 source files have been analyzed

[INFO] Sensor Deterministic Rule Engine for DataWeave [dre]
[INFO] Starting analysis of 9 files with 25 rules

[INFO] Sensor Deterministic Rule Engine for Mule [dre]
[INFO] Detected mule-artifact.json.
[INFO] Starting analysis of 6 files with 41 rules

[WARNING] Duplication reported for ‘<TEST_FILE>.xml’ will be ignored because it’s a test file.

[INFO] Dependency analysis skipped

[INFO] Analysis report generated in 4422ms
[INFO] Analysis report uploaded

[INFO] ANALYSIS SUCCESSFUL

[INFO] BUILD SUCCESS

Thankyou for clearing that up.

Everything looks normal in the logs with no obvious errors.

Could you share a minimal reproducer? A simplified, scaled-down version of your project without any sensitive data or proprietary code.

It will help isolate and troubleshoot the issue directly.

Hope this is okay:

customer-enquiry-api

├── src

│ ├── main

│ │ ├── mule

│ │ │ └── customer-enquiry-api.xml

│ │ │

│ │ └── resources

│ │ ├── mappings

│ │ │ ├── create-enquiry-request.dwl

│ │ │ ├── create-enquiry-response.dwl

│ │ │ ├── set-request-headers.dwl

│ │ │ └── ErrorHandlerUtils.dwl

│ │ │

│ │ ├── properties

│ │ │ ├── common.yaml

│ │ │ ├── dev.yaml

│ │ │ ├── qa.yaml

│ │ │ └── prod.yaml

│ │ │

│ │ └── log4j2.xml

│ └── test

│ └── munit

├── azure-pipelines.yml

├── pom.xml

└── mule-artifact.json