SonarQube Server

https://docs.sonarsource.com/sonarqube-server
Admin
SonarQube Server is an on-premises automated code review and static analysis tool designed to detect...
Tokens:611,178
Snippets:5,138
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Start SonarQube on Windows with StartSonar.bat

Source: https://docs.sonarsource.com/sonarqube-server/quickstart-guide/installing-sonarqube-server-with-sql-server

Commands to start SonarQube on Windows. Navigate to the bin directory, run StartSonar.bat to start in the foreground, or install as a Windows service with InstallNTService.bat and then start it with net start SonarQube.

```batch
# Navigate to the SonarQube bin directory
cd C:\sonarqube\bin\windows-x86-64\

# Start SonarQube
StartSonar.bat

# Or install as a Windows service
InstallNTService.bat
net start SonarQube
```

--------------------------------

### Start SonarQube Server from zip file (deprecated)

Source: https://docs.sonarsource.com/sonarqube-server/try-out-sonarqube

Commands to start SonarQube Server from a zip installation. On Windows, run StartSonar.bat; on other operating systems, run sonar.sh console as a non-root user. Requires Java 21 and a non-root user.

```bash
# On Windows, execute:
C:\sonarqube\bin\windows-x86-64\StartSonar.bat
 
# On other operating systems, as a non-root user execute:
/opt/sonarqube/bin/<OS>/sonar.sh console
```

--------------------------------

### Start SonarQube on Linux/macOS with sonar.sh

Source: https://docs.sonarsource.com/sonarqube-server/quickstart-guide/installing-sonarqube-server-with-sql-server

Commands to start SonarQube on Linux/macOS. Navigate to the bin directory, start the server with sonar.sh start, check its status, and tail the log file for output.

```bash
# Navigate to the SonarQube bin directory
cd /opt/sonarqube/bin/linux-x86-64/

# Start SonarQube
./sonar.sh start

# Check status
./sonar.sh status

# View logs
tail -f /opt/sonarqube/logs/sonar.log
```

--------------------------------

### Scripted pipeline example for other scanners

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/ci-integration/jenkins-integration/add-analysis-to-job

Uses the tool step to get the scanner home and withSonarQubeEnv to run the sonar-scanner binary. The scannerHome must match an actual scanner installation directory on the Jenkins build agent.

```groovy
node {
  stage('SonarQube analysis') {
    def scannerHome = tool '<sonarqubeScannerInstallation>'; // must match the name of an actual scanner installation directory on your Jenkins build agent
    withSonarQubeEnv('<sonarqubeInstallation>') { // If you have configured more than one global server connection, you can specify its name as configured in Jenkins
      sh "${scannerHome}/bin/sonar-scanner"
    }
  }
}
```

--------------------------------

### Generate example Compose bundle with generate.py

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/ai-agents/deploying-with-docker-compose

Generates the example Compose bundle for an existing SonarQube Server (--edition none) with external PostgreSQL, S3 storage, all three components, and TLS off. The output is written to the 'example' directory.

```bash
python3 generate.py --edition none \
  --db external --db-host db.example.com --db-password changeme \
  --storage s3 --s3-bucket agentic-bucket --s3-region eu-west-1 \
  --s3-access-key AKIAEXAMPLE --s3-secret-key changeme \
  --tls off --sonarqube-external-host sonarqube.example.com --sonarqube-external-port 9000 \
  --host-gateway off --out example
```

--------------------------------

### Docker Compose example for signing-init and orchestrator services

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/ai-agents/deploying-with-docker-compose

Docker Compose example defining the signing-init and orchestrator services for the SonarQube agentic signing setup. The signing-init service validates that AGENTIC_SIGNING_SECRET is at least 32 characters, writes it to /tmp/instance-secret, and derives signing keys into shared volumes; the orchestrator service mounts those keys read-only and depends on signing-init completing successfully. The orchestrator uses a 2580s stop_grace_period to cover web drain and db-scheduler shutdown phases, and requires the AGENTIC_SIGNING_SECRET environment variable to be set in .env.

```yaml
services:
  signing-init:
    image: sonarsource/sonarqube-agent-orchestrator:2026.5.0
    user: "0:0"
    # Root only to own the key volumes it creates; it needs no capability on top of that.
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -eu
        [ $${#AGENTIC_SIGNING_SECRET} -ge 32 ] ||
          { echo "AGENTIC_SIGNING_SECRET is shorter than 32 characters — SonarQube requires at" \
            "least that many bytes and disables verification on a shorter one, silently. Use:" \
            "openssl rand -hex 32" >&2; exit 1; }
        printf '%s' "$$AGENTIC_SIGNING_SECRET" > /tmp/instance-secret
        true
        /derive-keys.sh --secret-file /tmp/instance-secret \
          --label agentic-shared=/run/agentic-signing/orchestrator/agentic-shared.key \
          --label orchestrator-job-capability=/run/agentic-signing/orchestrator/orchestrator-job-capability.key \
          --label hunter-to-orchestrator=/run/agentic-signing/orchestrator/hunter-to-orchestrator.key \
          --label remediation-to-orchestrator=/run/agentic-signing/orchestrator/remediation-to-orchestrator.key \
          --label orchestrator-to-hunter=/run/agentic-signing/orchestrator/orchestrator-to-hunter.key \
          --label orchestrator-to-hunter=/run/agentic-signing/hunter/orchestrator-to-hunter.key \
          --label hunter-to-orchestrator=/run/agentic-signing/hunter/hunter-to-orchestrator.key \
          --label orchestrator-to-remediation=/run/agentic-signing/orchestrator/orchestrator-to-remediation.key \
          --label orchestrator-to-remediation=/run/agentic-signing/remediation/orchestrator-to-remediation.key \
          --label remediation-to-orchestrator=/run/agentic-signing/remediation/remediation-to-orchestrator.key \
          --label remediation-to-sqs=/run/agentic-signing/remediation/remediation-to-sqs.key \
          --label agentic-shared=/run/agentic-signing/vortex/agentic-shared.key
    environment:
      AGENTIC_SIGNING_SECRET: ${AGENTIC_SIGNING_SECRET:?set AGENTIC_SIGNING_SECRET in .env, see README}
    volumes:
      - agentic_signing_orchestrator:/run/agentic-signing/orchestrator
      - agentic_signing_hunter:/run/agentic-signing/hunter
      - agentic_signing_remediation:/run/agentic-signing/remediation
      - agentic_signing_vortex:/run/agentic-signing/vortex

  orchestrator:
    image: sonarsource/sonarqube-agent-orchestrator:2026.5.0
    # Covers the graceful web drain plus the two db-scheduler shutdown phases (5m + 15m) after it.
    stop_grace_period: 2580s
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 1024M
    cpus: 1
    volumes:
      - agentic_signing_orchestrator:/run/agentic-signing:ro

    environment:
      <<: *job-storage-env
      # The URLs it presigns for a job must outlive the longest one (Hunter's 44400s deadline), so
      # it doesn't take AGENTIC_STORAGE_PRESIGN_TTL_SECONDS, which SonarQube and Vortex use.
      SONAR_AGENTIC_ORCHESTRATOR_STORAGE_PRESIGN_TTL_SECONDS: "45000"
      SERVER_PORT: "8080"
      CORE_DB_READ_WRITE_ENDPOINT: db.example.com:5432
      CORE_DB_NAME: sonarqube
      CORE_DB_USERNAME: "sonarqube"
      CORE_DB_PASSWORD: "changeme"
      SPRING_DATASOURCE_URL: jdbc:postgresql://db.example.com:5432/sonarqube?ApplicationName=agentic-orchestrator&sslmode=verify-full&sslfactory=org.postgresql.ssl.DefaultJavaSSLFactory
      AGENTIC_SONARQUBE_URL: http://sonarqube.example.com:9000
      AGENTIC_SONARQUBE_SIGNING_KEY_PATH: /run/agentic-signing/agentic-shared.key
      AGENTIC_GITHUB_API_BASE_URL: https://api.github.com
      AGENTIC_HUNTER_RUNTIME_PUSH_URL: http://hunter-runtime:8090/jobs
      AGENTIC_HUNTER_RUNTIME_SIGNING_KEY_PATH: /run/agentic-signing/orchestrator-to-hunter.key
      AGENTIC_REMEDIATION_RUNTIME_PUSH_URL: http://remediation-agent-runtime:8090/jobs
      AGENTIC_REMEDIATION_RUNTIME_SIGNING_KEY_PATH: /run/agentic-signing/orchestrator-to-remediation.key
      AGENTIC_INBOUND_HUNTER_VERIFICATION_KEY_PATH: /run/agentic-signing/hunter-to-orchestrator.key
      AGENTIC_INBOUND_REMEDIATION_VERIFICATION_KEY_PATH: /run/agentic-signing/remediation-to-orchestrator.key
      AGENTIC_INBOUND_VERIFICATION_KEY_PATH: /run/agentic-signing/agentic-shared.key
      AGENTIC_JOB_CAPABILITY_SIGNING_KEY_PATH: /run/agentic-signing/orchestrator-job-capability.key
    depends_on:
      signing-init:
        condition: service_completed_successfully
```

--------------------------------

### Install plugin with helm upgrade

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/plugins/install-a-plugin

Use the helm upgrade command to install a plugin by setting the plugins.install value. The example installs the sonar-cxx plugin version 2.0.7.3119.

```bash
helm upgrade --install -n sonarqube sonarqube sonarqube/sonarqube \
 --set "plugins.install={https://github.com/SonarOpenCommunity/sonar-cxx/releases/download/cxx-2.0.7/sonar-cxx-plugin-2.0.7.3119.jar}"
```

--------------------------------

### Start SonarQube service

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/from-zip-file/starting-stopping-server/running-as-a-service

Once registration is complete, start the SonarQube service with this command.

```shell
sudo service sonar start
```

--------------------------------

### Install and verify istiod

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/on-kubernetes-or-openshift/migrating-from-ingress-nginx-to-gateway-api

Install the `istiod` control plane and verify it. If the `istio` `GatewayClass` is missing, the CRDs from step 1 were not established before installing `istiod`; reinstall `istiod` after confirming the CRDs are established. There is no separate `helm install ... istio/gateway` step; with the Gateway API pattern, Istio auto-provisions a dedicated Deployment and Service for each `Gateway` resource.

```bash
helm install istiod istio/istiod -n istio-system --wait
```

```bash
helm status istiod -n istio-system
kubectl get deployments -n istio-system --output wide
kubectl get gatewayclass istio -o jsonpath='{.spec.controllerName}'
# Expected: istio.io/gateway-controller
```

--------------------------------

### Enable and start SonarQube service

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/from-zip-file/starting-stopping-server/running-as-a-service

Enable and start the SonarQube systemd service after creating the unit file.

```bash
sudo systemctl enable sonarqube.service
sudo systemctl start sonarqube.service
```

--------------------------------

### Install dotnet-coverage as a global dotnet tool

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/test-coverage/dotnet-test-coverage

Installs the dotnet-coverage tool globally using the dotnet tool install command. Requires .NET Core 3.1 or later.

```shell
dotnet tool install --global dotnet-coverage
```

--------------------------------

### Start SonarQube Server from ZIP file

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/from-zip-file/starting-stopping-server/from-zip-file

Commands to start SonarQube Server from the ZIP file on Linux, macOS, and Windows. The startup is successful when the "SonarQube is operational" message is displayed.

```bash
<sonarqubeHome>/bin/linux-x86-64/sonar.sh start
```

```bash
<sonarqubeHome>/bin/macosx-universal-64/sonar.sh start
```

```batch
<sonarqubeHome>\bin\windows-x86-64\StartSonar.bat
```

--------------------------------

### Scripted pipeline example for Maven

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/ci-integration/jenkins-integration/add-analysis-to-job

Uses withSonarQubeEnv with credentialsId and installationName to override credentials and select a specific SonarQube installation. Runs the Maven SonarQube scanner via sh 'mvn org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922:sonar'.

```groovy
node {
  stage('SonarQube analysis') {
    withSonarQubeEnv(credentialsId: 'f225455e-ea59-40fa-8af7-08176e86507a', installationName: '<sonarqubeInstallation>') { // You can override the credential to be used, If you have configured more than one global server connection, you can specify the corresponding SonarQube installation name configured in Jenkins
      sh 'mvn org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922:sonar'
    }
  }
}
```

--------------------------------

### Good example: file_get_contents with neutral URL

Source: https://docs.sonarsource.com/sonarqube-server/extension-guide/adding-coding-rules

Recommended replacement for the bad example. Uses a neutral website or localhost.

```php
$fp = file_get_contents("https//www.example.com");
// or even better:
$fp = file_get_contents("https://localhost");
```

--------------------------------

### Install cargo-sonar-scanner with cargo binstall

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner-for-cargo

Downloads a prebuilt binary of cargo-sonar-scanner instead of compiling from source. Requires cargo-binstall to be installed.

```bash
cargo binstall cargo-sonar-scanner
```

--------------------------------

### SonarQubePrepare@8 YAML example

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/ci-integration/azure-pipelines/sonarqube-tasks

Example YAML configuration for the Prepare Analysis Configuration task using CLI mode and manual configuration. The task invokes the scanner on your behalf and handles the prefix internally for properties passed via extraProperties.

```yaml
- task: SonarQubePrepare@8
  inputs:
    SonarQube: '<YourSonarQubeServiceEndpoint>'
    scannerMode: 'cli'
    configMode: 'manual'
    cliProjectKey: '<YourProjectKey>'

```

--------------------------------

### Start analysis with sonar-scanner-npm

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/npm/using

Starts the analysis from the command line using the sonar-scanner-npm command. Pass analysis parameters with the standard -Dsonar.xxx=yyy syntax. The project key is optional; it defaults to the name field of package.json, but can be overridden with -Dsonar.projectKey.

```bash
sonar-scanner-npm -Dsonar.host.url=https://myserver.com -Dsonar.token=019d1e2e04e
```

--------------------------------

### Install JDK development tools on SUSE Linux

Source: https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/troubleshooting/elasticsearch

Run this command to install development tools for JDK on SUSE Linux, which resolves Elasticsearch startup crashes with UnsatisfiedLinkError. Requires JDK 21 or 25 installed.

```bash
sudo zypper install java-21-openjdk-devel
```

--------------------------------

### Install base chart (Istio CRDs)

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/on-kubernetes-or-openshift/migrating-from-ingress-nginx-to-gateway-api

Install Istio's cluster-wide CRDs via the `istio-base` chart. Verify with `helm ls -n istio-system`; it should show `istio-base` as `deployed`.

```bash
helm install istio-base istio/base -n istio-system --create-namespace --set defaultRevision=default
```

--------------------------------

### Bad example: file_get_contents with real company URL

Source: https://docs.sonarsource.com/sonarqube-server/extension-guide/adding-coding-rules

Example of a code example that should not be used because it references a real company. Replace with a neutral website.

```php
$fp = file_get_contents("https://www.real-company.com");
```

--------------------------------

### Install SonarScanner for .NET via dotnet tool

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/dotnet-environments/getting-started-with-net

Installs the SonarScanner for .NET as a .NET global tool. The --version argument is optional; if omitted, the latest version is installed. Requires .NET Core 3.1 or later.

```bash
dotnet tool install --global dotnet-sonarscanner --version x.x.x
```

--------------------------------

### Install dotCover as a global dotnet tool

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/test-coverage/dotnet-test-coverage

Installs the JetBrains dotCover command line tools as a global dotnet tool.

```shell
dotnet tool install --global JetBrains.dotCover.CommandLineTools
```

--------------------------------

### Oracle to Postgres copy example

Source: https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/maintenance/sonarqube-db-copy-tool

Example of a copy from an Oracle to a Postgres database. Each parameter is on one line with backslash (\\) continuations; use a single line without backslashes if your shell does not support them.

```bash
java \
-cp ojdbc11-21.8.0.0.jar:sonar-db-copy-1.7.0.5273.jar com.sonar.dbcopy.StartApp \
-urlSrc jdbc:oracle:thin:@10.18.51.1:1521/XEPDB1 \
-userSrc sonar \
-pwdSrc 05xlAz1EhgQb9Pl8 \
-urlDest jdbc:postgresql://10.10.1.138/sonarqube \
-userDest sonar \
-pwdDest Ck23L1OpqF4BdwJv
```

--------------------------------

### jmxremote.access file example

Source: https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/monitoring/instance

Example of the jmxremote.access file defining read-only and read-write access roles.

```properties
#
# JMX Access Control file
#
reader readonly
admin  readwrite \
    create javax.management.monitor.*,javax.management.timer.*,com.sun.management.*,com.oracle.jrockit.* \
    unregister
```

--------------------------------

### Example: Create Kubernetes secret with encryption key

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/on-kubernetes-or-openshift/encrypting-helm-chart-sensitive-data

Example command that creates a Kubernetes secret named 'myEncryptionKeySecret' with the encryption key value 'EgycYJc4Ek4uj2pH39e3+bnnk15IrVu4dxtfjDyN1y8='.

```bash
kubectl create secret generic --from-literal sonar-secret.txt=EgycYJc4Ek4uj2pH39e3+bnnk15IrVu4dxtfjDyN1y8= myEncryptionKeySecret
```

--------------------------------

### Start deployment and check status with docker compose

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/ai-agents/deploying-with-docker-compose

Starts the deployment and confirms each component reports healthy. Run after SonarQube has created its schema, since the orchestrator keeps failing its health check until then.

```bash
docker compose up -d
docker compose ps
```

--------------------------------

### Example of resulting PKCS#8 private key

Source: https://docs.sonarsource.com/sonarqube-server/instance-administration/authentication/saml/how-to-set-up-keycloak

Example output of the conversion script, showing the PKCS#8 private key in a single line without newlines. This is the format SonarQube expects.

```text
-----BEGIN PRIVATE KEY-----MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC3qfa8mtiJVCg1RkDFOxfuqk0Gd/R5ULalxC/8fUcDPyGzH0LXD8TYRpPj0b067rqSa0Exg77ZtgDzoz/H9nUaKEwz4C0Cg7U31F2UOgA0IsGQYzJk4YyKmWBbcbkRRnJi9FS672ZIsQQR82XkLplWVw4BIYGXl/Zkb5bMh3AUAOQUMCej5SBqxOxeYRI4l0A0MhnnIwkkIEALjkzbI9LrxWxj3hi7FYLObNOMxSzKr6Zpttv7tO/6QBcCK0ux2WAjKz0oCvzSEq/qXFodKifHFIdlrpldbjBP0gsUU9xOe1X6PqBynnqdNy9s8WZu5TeGFaK3aEOZD93KrMKAWUrnAgMBAAECggEALwEIHQ/SEB9iJPREWlW708Bw8xFbF3sxK25wy4EyXeHX2ZRMEmc+PQ2fBsSkVcNIK3XYmvf5LZW3W6MxjRcFtDqQ+gvK6SRVCiNHCcroR2+Hs1C30nqo8cW8E9sgfovVdX7LeoYPWtY20PNGZeYJJ0AjXOW62VWyYNTwNosJA40hq5jsd/ktmwd5o1zKPbaMplrWtVlt3UKii3YfeTodOIE/FSHtVL14PcyeYZxgCxJp2gGHvqMjOmBgs89kwkP7+vtYg1Rn8Cj3CzkVDnsHiuDaaSuScntgRXMywhEH6oBs/aFzvA3zhiMW17146TB1eAtKAnVNk8kcC58b5In7qQKBgQDk18Snz10obdw8U9IxY9LtvsKEx6uti7ROtScAi8wJOquYUhx2kTbT0xkfgNhqe+cpPvTx50Av1Fi9x8y5yTCtSocagQHMF0WyAKoBTRi+wgshsgmVNn+UQmUMuTMsU+1TkOC0iw8WuyYvuYqnZh3stwt/mYt//bMH0eKH66y0fwKBgQDNdamkV0+CZeMdNIxGOUUTbmo/QfGFLUB/1Qf1UAsu6iuIQHn9NoDLACrhI0noQKhoODyQjT/3HDXE4CnEKu9ooUrQ3scklj9FYxMKudQRS+mTtE0ZXe9uD0+rht4Ev9cPAqmZEGa6ZoZ6o84ors/vtBDYL7kX/r7N8pNVvy0VmQKBgQCaezHNGoXHsgn3S5pcLwgH6DuFyQiSufl5HH78tmKBZHLL+7otLDA35IxUIPV3RLcyt8ZAupww7YcObh88150djm8PrEDbVmZ9GEerYzEuLO24zGf9q3GKUxvF8Aukg+909xtJpYoFDUdk9jqscJoI3zRK6gsq1seRotTqbmUC3wKBgQCRXuky0Fv/ZVu2dFGz9h17zCn8rAnZMtVqHS7OUV44SZOXihdGI+QoveuY9ED8xZLierfPh0F09E7PB9RFaiOOomCvPJEmv+/whlMYybbUriOMUIwkoKQh+U9ji79XGO1vP3EETeiBhr0r1O6vNlEFxyAL9mg+JA6Y5UN97hBWMQKBgQCLH/9epJo01mGe+9h0Q1zoBpTGllJXtiOwKAf0JzqKEkVwFtuzgzC3WD1Ru0X85X6pbgyignKe60ZmFa8+nKmgF4IUKtNQmw7+poUzruw9BdOlpdnFrMU05k7hV0s1frwd+L/GLtBP62fw9QSLoWHE25X5Uq8OvI77wV6NwYS/PA==-----END PRIVATE KEY----
```

--------------------------------

### Install or uninstall SonarQube as a Windows service

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/from-zip-file/starting-stopping-server/running-as-a-service

Use these commands to install or uninstall the SonarQube service on Windows. Replace <sonarqubeHome> with the actual installation path.

```bat
> <sonarqubeHome>\bin\windows-x86-64\SonarService.bat install
> <sonarqubeHome>\bin\windows-x86-64\SonarService.bat uninstall
```

--------------------------------

### Start analysis with npx @sonar/scan

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/npm/using

Starts the analysis from the command line using npx @sonar/scan. Pass analysis parameters with the standard -Dsonar.xxx=yyy syntax.

```bash
npx @sonar/scan -Dsonar.host.url=https://myserver.com -Dsonar.token=019d1e2e04e
```

--------------------------------

### Install SonarScanner for NPM globally

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/npm/installing

Installs the SonarScanner for NPM globally on your system.

```bash
npm install -g @sonar/scan
```

--------------------------------

### Run sonar goal as dedicated step

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner-for-maven

Runs the sonar goal as a dedicated step after installing the project. Use install as the first step for multi-module projects.

```bash
mvn clean install
mvn org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.token=myAuthenticationToken
```

--------------------------------

### Start and check Docker Compose cluster

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/data-center-edition/from-docker-image

Run these commands in the folder containing your docker-compose.yml to start the Data Center Edition cluster and then check the health of all nodes.

```bash
docker-compose up -d
```

```bash
docker-compose ps
```

--------------------------------

### Install Coverlet global dotnet tool

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/test-coverage/dotnet-test-coverage

Installs Coverlet as a global dotnet tool. Required before using Coverlet for test coverage.

```bash
dotnet tool install --global coverlet.console
```

--------------------------------

### Install SonarScanner for Python from testPyPI

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner-for-python

Installs the latest pre-released version of SonarScanner for Python from testPyPI, using PyPI as a fallback index.

```bash
pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ pysonar
```

--------------------------------

### Install SonarQube on OpenShift with Helm

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/on-kubernetes-or-openshift/installing-helm-chart

Run these commands to add the SonarQube Helm repository, update it, create the 'sonarqube' namespace, set required environment variables (including MONITORING_PASSCODE, EDITION, JDBC settings), and install or upgrade the SonarQube chart with OpenShift enabled. The EDITION variable is set to 'developer' by default; choose your edition as needed.

```bash
helm repo add sonarqube https://SonarSource.github.io/helm-chart-sonarqube
helm repo update
kubectl create namespace sonarqube
export MONITORING_PASSCODE="yourPasscode"
export EDITION="developer" # Choose your edition
export JDBC_URL="jdbc:postgresql://myPostgres/myDatabase"
export JDBC_USERNAME="jdbc-username"
export JDBC_PASSWORD_SECRET_NAME="jdbc-secret"
export JDBC_PASSWORD_SECRET_KEY="jdbc-password"
helm upgrade --install -n sonarqube sonarqube sonarqube/sonarqube \
  --set edition=$EDITION \
  --set OpenShift.enabled=true \
  --set monitoringPasscode=$MONITORING_PASSCODE \
  --set jdbcOverwrite.jdbcUrl=$JDBC_URL \
  --set jdbcOverwrite.jdbcUsername=$JDBC_USERNAME \
  --set jdbcOverwrite.jdbcSecretName=$JDBC_PASSWORD_SECRET_NAME \
  --set jdbcOverwrite.jdbcSecretPasswordKey=$JDBC_PASSWORD_SECRET_KEY
```

--------------------------------

### Example %INCLUDE interpretation

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/languages/pli

Example of how SonarQube interprets %INCLUDE statements when Ddnames are configured. Shows the mapping from %INCLUDE O (XX02511) to a file path and %INCLUDE lib1 to another path.

```PL/I
%INCLUDE O (XX02511) as %INCLUDE 'C:/temp/o/XX02511.99IPO';
%INCLUDE lib1 as %INCLUDE 'C:/temp/syslib/lib1.pli';
```

--------------------------------

### jmxremote.password file example

Source: https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/monitoring/instance

Example of the jmxremote.password file with passwords for reader and admin roles. Apply chmod 600 or 400 for security.

```properties
#
# JMX Access Password file
#
reader readerpassword
admin  adminpassword
```

--------------------------------

### GET /api/measures/component

Source: https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api

Example of a GET request to the /api/measures/component endpoint to extract measures for a given metric and project.

```APIDOC
## GET /api/measures/component

### Description
Extracts measures of a given metric for a given project. For private projects, the user used to create the user-type token must have Browse permission on the project.

### Method
GET

### Endpoint
/api/measures/component

### Parameters
#### Query Parameters
- **metricKeys** (string) - Required - Comma-separated list of metric keys to retrieve (e.g., ncloc, code_smells, complexity).
- **component** (string) - Required - The project key for which measures are extracted.

### Request Example
```
curl --request GET \
  --url 'https://sonarqube.com/api/measures/component?metricKeys=ncloc%2Ccode_smells%2Ccomplexity&component=<myProjectKey>' \
  --header 'Authorization: Bearer <myToken>' 
```

### Response
#### Success Response (200)
- **component** (object) - Contains the component details and measures.
  - **id** (string) - Component ID.
  - **key** (string) - Component key.
  - **name** (string) - Component name.
  - **qualifier** (string) - Component qualifier (e.g., TRK).
  - **measures** (array) - List of measures.
    - **metric** (string) - Metric key.
    - **value** (string) - Metric value.
    - **bestValue** (boolean) - Optional - Indicates if the value is the best value.

#### Response Example
```
{
   "component": {
      "id": "id",
      "key": "my_project_key",
      "name": "my_project_name",
      "qualifier": "TRK",
      "measures": [
         {
            "metric": "complexity",
            "value": "4214"
         },
         {
            "metric": "code_smells",
            "value": "8595",
            "bestValue": false
         },
         {
            "metric": "ncloc",
            "value": "51667"
         }
      ]
   }
}
```
```

--------------------------------

### Scripted pipeline example for .NET

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/ci-integration/jenkins-integration/add-analysis-to-job

Uses the 'Scanner for .Net Framework' tool and withSonarQubeEnv to run SonarScanner.MSBuild.exe begin, MSBuild.exe /t:Rebuild, and SonarScanner.MSBuild.exe end. Note the missing opening quote before <sonarqubeInstallation> in the source.

```groovy
node {
  stage('Build + SonarQube analysis') {
    def sqScannerMsBuildHome = tool 'Scanner for .Net Framework'
    withSonarQubeEnv(<sonarqubeInstallation>') {// If you have configured more than one global server connection, you can specify its name as configured in Jenkins
      bat "${sqScannerMsBuildHome}\\SonarScanner.MSBuild.exe begin /k:myKey"
      bat 'MSBuild.exe /t:Rebuild'
      bat "${sqScannerMsBuildHome}\\SonarScanner.MSBuild.exe end"
    }
  }
}
```

--------------------------------

### Configure plugins in values.yaml

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/plugins/install-a-plugin

Add the plugins section to your values.yaml file to install a plugin via Helm. The example installs the sonar-cxx plugin version 2.0.7.3119.

```yaml
plugins:
  install:
   - "https://github.com/SonarOpenCommunity/sonar-cxx/releases/download/cxx-2.0.7/sonar-cxx-plugin-2.0.7.3119.jar"
```

--------------------------------

### Migration status response

Source: https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/update/post-update-steps

Example response from GET /api/hotspots/migration_status showing the number of remaining hotspots and whether migration is complete.

```json
{
  "remainingHotspots": 31668,
  "complete": false
}
```

--------------------------------

### JSON response from /api/measures

Source: https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api

Example response from the GET /api/measures request, showing measures for complexity, code_smells, and ncloc metrics.

```json
{
   "component": {
      "id": "id",
      "key": "my_project_key",
      "name": "my_project_name",
      "qualifier": "TRK",
      "measures": [
         {
            "metric": "complexity",
            "value": "4214"
         },
         {
            "metric": "code_smells",
            "value": "8595",
            "bestValue": false
         },
         {
            "metric": "ncloc",
            "value": "51667"
         }
      ]
   }
}
```

--------------------------------

### Docker Compose example for SonarQube AI agents

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/ai-agents/deploying-with-docker-compose

Example Compose file for deploying SonarQube AI agents with Docker Compose. It defines the orchestrator, hunter-runtime, remediation-agent-runtime, and egress-proxy services, including healthchecks, resource limits, security options, and environment variables for agentic signing and proxy configuration.

```yaml
    ports:
      - "${ORCHESTRATOR_PUBLISH_PORT:-9091}:8080"
    networks: [control, data, hunter-jobnet, remediation-jobnet]
    healthcheck:
      # /readyz, as the Helm chart probes: /health aggregates the database and storage checks and
      # turns 503 for the whole drain on stop.
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/readyz"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 60s
```

```yaml
  hunter-runtime:
    image: sonarsource/sonarqube-hunter-agent:2026.5.0
    runtime: runsc
    pids_limit: 512
    # Just above the image's own 44400s graceful-shutdown wait for a running job, so a stop doesn't
    # kill it before that wait ends.
    stop_grace_period: 44430s
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 8192M
    cpus: 2
    volumes:
      - agentic_signing_hunter:/run/agentic-signing:ro

    environment:
      SCRIPT_PATH: /home/agent/app/.venv/bin/detection-agent
      PLAYBOOK_KEY: appsec
      PLAYBOOK_VERSION: stable
      HTTPS_PROXY: http://egress-proxy:3128
      HTTP_PROXY: http://egress-proxy:3128
      NO_PROXY: localhost,127.0.0.1
      # Some HTTP clients read only the lower-case names.
      https_proxy: http://egress-proxy:3128
      http_proxy: http://egress-proxy:3128
      no_proxy: localhost,127.0.0.1
      AGENTIC_VERIFY_KEY_ID: orchestrator-to-hunter
      AGENTIC_VERIFY_KEY_PATH: /run/agentic-signing/orchestrator-to-hunter.key
      AGENT_ORCHESTRATOR_URL: http://orchestrator:8080
      AGENT_ORCHESTRATOR_SIGNING_KEY_PATH: /run/agentic-signing/hunter-to-orchestrator.key
    depends_on:
      egress-proxy:
        condition: service_healthy
      signing-init:
        condition: service_completed_successfully
    networks: [hunter-jobnet]
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8090/readyz"]
      interval: 5s
      timeout: 3s
      retries: 20
```

```yaml
  remediation-agent-runtime:
    image: sonarsource/sonarqube-remediation-agent:2026.5.0
    runtime: runsc
    pids_limit: 512
    # Just above the image's own 3600s graceful-shutdown wait for a running job, so a stop doesn't
    # kill it before that wait ends.
    stop_grace_period: 3630s
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 8192M
    cpus: 4
    volumes:
      - agentic_signing_remediation:/run/agentic-signing:ro

    environment:
      REMEDIATION_SCRIPT_PATH: /home/agent/app/.venv/lib/python3.13/site-packages/remediation_agent/main.py
      # egress-proxy's remediation-only listener: the one its SonarQube rules match on.
      HTTPS_PROXY: http://egress-proxy:3129
      HTTP_PROXY: http://egress-proxy:3129
      NO_PROXY: localhost,127.0.0.1
      # Some HTTP clients read only the lower-case names.
      https_proxy: http://egress-proxy:3129
      http_proxy: http://egress-proxy:3129
      no_proxy: localhost,127.0.0.1
      REMEDIATION_RULE_INFO_ENDPOINT: http://sonarqube.example.com:9000/api/rules/show
      REMEDIATION_ANALYSIS_ENDPOINT: http://sonarqube.example.com:9000/api/v2/a3s/private/analyses
      REMEDIATION_AGENTIC_SIGNING_KEY_PATH: /run/agentic-signing/remediation-to-sqs.key
      AGENTIC_VERIFY_KEY_ID: orchestrator-to-remediation
      AGENTIC_VERIFY_KEY_PATH: /run/agentic-signing/orchestrator-to-remediation.key
      AGENT_ORCHESTRATOR_URL: http://orchestrator:8080
      AGENT_ORCHESTRATOR_SIGNING_KEY_PATH: /run/agentic-signing/remediation-to-orchestrator.key
    depends_on:
      egress-proxy:
        condition: service_healthy
      signing-init:
        condition: service_completed_successfully

    networks: [remediation-jobnet]
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8090/readyz"]
      interval: 5s
      timeout: 3s
      retries: 20
```

```yaml
  egress-proxy:
    image: ubuntu/squid:6.6-24.04_edge@sha256:8a3baed477e2c282ab8aa5edad442f69873246964f225c5c2ae8364b6610963c
    entrypoint: ["/bin/sh", "/usr/local/bin/render-and-run.sh"]
    # The image's proxy user. The entrypoint renders squid.conf into /tmp and runs Squid in the
    # foreground, logging to stdout, so nothing else on the root filesystem needs to be writable.
    user: "13:13"
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 128M
    cpus: 0.25
    environment:
      AGENTIC_LLM_ALLOWED_DOMAINS: api.anthropic.com
      AGENTIC_STORAGE_ALLOWED_DOMAIN: agentic-bucket.s3.eu-west-1.amazonaws.com
      AGENTIC_STORAGE_ALLOWED_PORT: "443"
      AGENTIC_SQS_PROXY_SCHEME: http
      AGENTIC_SQS_PROXY_HOST: sonarqube.example.com
      AGENTIC_SQS_PROXY_PORT: 9000
      AGENTIC_ORCHESTRATOR_PROXY_HOST: orchestrator
      AGENTIC_ORCHESTRATOR_PROXY_PORT: "8080"
    volumes:
      - ./egress-proxy/squid.conf.template:/etc/squid/squid.conf.template:ro
      - ./egress-proxy/entrypoint.sh:/usr/local/bin/render-and-run.sh:ro
```

--------------------------------

### Register SonarQube at boot time on Ubuntu

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/from-zip-file/starting-stopping-server/running-as-a-service

Register SonarQube to start at boot time on Ubuntu 64-bit. Creates a symlink from the SonarQube home's sonar.sh to /usr/bin/sonar, makes the init script executable, and uses update-rc.d to add it as a boot service.

```shell
sudo ln -s <sonarqubeHome>/bin/linux-x86-64/sonar.sh /usr/bin/sonar
sudo chmod 755 /etc/init.d/sonar
sudo update-rc.d sonar defaults
```

--------------------------------

### Build and mount a truststore for Vortex analysis

Source: https://docs.sonarsource.com/sonarqube-server/server-installation/ai-agents/deploying-with-docker-compose

Compose file fragment that adds a one-shot truststore-init service to build a truststore from certificates mounted at /custom-ca, then mounts that truststore into the vortex service and sets JAVA_TOOL_OPTIONS to point the JVM at it. The truststore-init service copies the JVM's default cacerts and imports every .crt/.pem file with keytool, using the default password changeit. The vortex service depends on truststore-init completing successfully before starting.

```yaml
volumes:
  truststore:

services:
  truststore-init:
    image: eclipse-temurin:21-jre
    command:
      - sh
      - -c
      - |
        cp "$$JAVA_HOME/lib/security/cacerts" /truststore/cacerts
        i=0
        for cert in /custom-ca/*.crt /custom-ca/*.pem; do
          [ -f "$$cert" ] || continue
          i=$$((i + 1))
          keytool -importcert -keystore /truststore/cacerts -storepass changeit \
            -noprompt -alias "custom-ca-$$i" -file "$$cert"
        done
    volumes:
      - ./custom-ca:/custom-ca:ro
      - truststore:/truststore

  vortex:
    environment:
      JAVA_TOOL_OPTIONS: -Djavax.net.ssl.trustStore=/truststore/cacerts -Djavax.net.ssl.trustStorePassword=changeit
    volumes:
      - truststore:/truststore:ro
    depends_on:
      truststore-init:
        condition: service_completed_successfully
```

--------------------------------

### Deprecated API component example with @Deprecated and @deprecated

Source: https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/maintenance/deprecations/deprecation-policy

Shows how to mark a Plugin API component as deprecated using the @Deprecated annotation and the @deprecated Javadoc tag. The Javadoc message must start with "in x.y" and include a replacement reference. This example uses "in 4.2" and references {@link #newMethod()}.

```java
/**
 * @deprecated in 4.2. Replaced by {@link #newMethod()}.
 */
@Deprecated
public void foo() {
...
}
```

--------------------------------

### Scripted pipeline example for Gradle

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/ci-integration/jenkins-integration/add-analysis-to-job

Uses withSonarQubeEnv() with no arguments to pick the global server connection. Runs the Gradle SonarQube scanner via sh './gradlew sonar'.

```groovy
node {
  stage('SonarQube analysis') {
    withSonarQubeEnv() { // Will pick the global server connection you have configured
      sh './gradlew sonar'
    }
  }
}
```

--------------------------------

### Example PHP JSON security configuration

Source: https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/security-engine-custom-configuration

Example JSON file for PHP security configuration. It defines sources, sanitizers, validators, passthroughs, and sinks. The 'args' field is mandatory for sanitizers and validators and must be a non-empty array of non-negative integers. Index starts at 1 for function calls and 0 for method calls (0 being 'this').

```json
{
  "sources": [
    {
      "methodId": "My\\Namespace\\ClassName\\ServerRequest::getQuery"
    }
  ],
  "sanitizers": [
    {
      "methodId": "str_replace",
      "args": [
        3
      ]
    }
  ],
  "validators": [
    {
     "methodId": "My\\Namespace\\Validator\\inArray::isValid",
     "args": [
        1
      ]
    }
  ],
 "passthroughs": [
    {
      "methodId": "rawurldecode",
      "args": [
        1
      ]
    }
  ],
  "sinks": [
    {
      "methodId": "mysql_query",
      "args": [
        1
      ]
    },
    {
      "methodId": "My\\Namespace\\SqlStatement::execute",
      "isMethodPrefix": true, // this is to say that all the methods starting with execute on the SqlStatement object will be considered
      "args": [
        0,
        1
      ]
    },
    {
      "methodId": "My\\Namespace\\SqlStatement::run",
      "interval": {
        "fromIndex": 1 // every parameter from the number 1 will be considered
      }
    }
  ]  
}
```

--------------------------------

### ExamplePlugin.java - Plugin entry point

Source: https://docs.sonarsource.com/sonarqube-server/extension-guide/developing-a-plugin/plugin-basics

Declares the plugin entry point class that implements org.sonar.api.Plugin and registers extension implementations via context.addExtensions().

```java
package org.sonarqube.plugins.example;
import org.sonar.api.Plugin;
 
public class ExamplePlugin implements Plugin {
  @Override
  public void define(Context context) {
    // implementations of extension points
    context.addExtensions(FooLanguage.class, ExampleProperties.class);
  }
}

```
Tokens:
Raw