Basic use of sonarqube platform

1、 perform sonar The way ：

jenkins Build time , perform sonar Code checking

jenkins Configuration see ：T-GKPT-Server（ Our company jenkins Platform projects , As follows ）

Analysis properties The contents are as follows （java Code ）：

sonar.projectKey=${JOB_NAME}     
sonar.projectName=${JOB_NAME}       
sonar.projectVersion=1.0      
sonar.sources=.     
sonar.java.binaries=.      
sonar.sourceEncoding=UTF-8
sonar.language=java
sonar.scm.disabled=true 
sonar.java.source=1.8 

Below is jenkins Data parsed during package operation ：

Analysis properties The contents are as follows （JavaScript Code ）：

sonar.projectKey=${JOB_NAME}
sonar.projectName=${JOB_NAME}
sonar.projectVersion=1.0
sonar.sources=.
sonar.projectBaseDir=src
sonar.sourceEncoding=UTF-8
sonar.language=js

Below is jenkins Data parsed during package operation ：

2、jenkins And sonar relation

After execution sonar The inspection results are automatically displayed in sonarqube In the platform （ This platform built by our company ）

jenkins The configuration is as follows ：

1、configure system【 To configure sonarqube Platform address 】

2、 Global Tool Configuration

1） To configure MSbuild

 2） To configure SonarScanner for MSBuild

3） SonarQube Scanner

3、Manage Nodes and Clouds

1） Set up master or slave node （ Servers that need to be packaged ）

 

2） On the packaged server node , install sonar-scanner

a）windows Install the green version of , Unzip directly into a folder

b） Modify the configuration file 【/conf/sonar-runner.properties】, The contents are as follows ：

#Configure here general information about the environment, such as SonarQube server connection details for example
#No information about specific project should appear here

#----- Default SonarQube server
sonar.host.url=http://172.17.2.10:9000/sonarqube

#----- Default source code encoding
sonar.sourceEncoding=UTF-8

c） Set the environment variable （ It may be a non essential step , Not verified ）

 

3、 Sign in sonarqube Platform and view the inspection results

  Focus on content ：

1、bugs And loopholes ： Generally, you can pay attention to these two items , Don't pay attention to the rest

2、 When bugs Or the vulnerability is not 0 when , Click on the number , Enter the specific content

For example, click the number above the vulnerability , Enter the vulnerability interface ：

The severity is blocking and severe , Generally, it needs to be handled ;（ Whether to solve the problem specifically , To what extent , Ask the project manager ）

3、

4、 Quality configuration - Configure check rules  

Different kinds of code , Configure different rules