guide sonar qube setup

Table of Contents

• Prerequisites
• Quality Profiles
• Quality Gates

SonarQube is the recommended tool for continuous quality analysis. Ideally you will get it out-of-the-box and pre-configured with the ProductionLine otherwise you can set it up yourself what is described here.

Prerequisites

You need to have the following components installed on your server:

• SonarQube version 6.7.1 (LTS) (or above)

• Java/JDK version 1.8

• NodeJS (latest LTS)

• NPM (simply do npm install -g npm@latest)

• TSLint (simply do npm install -g tslint)

Inside SonarQube you need to install the following plugins (most of them via Marketplace as admin):

• CSS / SCSS / Less

• Checkstyle

• Findbugs

• PMD

• SonarC#

• SonarTS

• SonarXML

• Web

• Devon Architecture Rules

• OWASP

Quality Profiles

Import all quality profiles from here.

Each profile should be set as default. If you hit issues in your projects (missing findings, false-positives, etc.) feel free to adjust the config to your needs. However, be aware that we put a lot of energy into this config and the rules are there for reason. Only drop rules or lower the severity of rules if this really makes sense for your project (and not just for being lazy and getting rid of warnings - instead consider the findings as valuable input).

Further the following rules are not activated in our config because they only make sense in specific situations and need to be configured according to your project:

• squid:S1451 (Track lack of copyright and license headers)

Quality Gates

Quality gates unfortunately can not be imported and exported.