Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can you make SonarQube version 5.2 fail a Jenkins Build?

Version of SonarQube = 5.2

So I noticed that my application was failing a quality gate in sonar but the build was still going green.

I googled how to make sonar fail the build and got results for a plugin called "build breaker" which has been depreciated for the version I'm using (http://docs.sonarqube.org/display/PLUG/Build+Breaker+Plugin). I cant find information on how to achieve the same build breaking behaviour in this version.

I cant seen any Jenkins plugin options that achieve this build breaking functionality ether.

Any help with this would be greatly appreciated!

Could I also suggest that someone with reputation over 1500 create a new tag for this version of sonarqube (sonarqube5.2).

like image 231
DavedCusack Avatar asked Nov 23 '15 14:11

DavedCusack


People also ask

Why should we need to integrate SonarQube and Jenkins?

Basically Integrating SonarQube and Jenkins provides you the ability to analyze your code when you run a job which contains SonarQube execution within it and generates an analysis of that code in your SonarQube Server.

What is a sonar scan used for in Jenkins?

2. What is SonarQube? SonarQube is an open-source platform, which is used for continuous analysis of source code quality by performing analysis on your code to detect duplications, bugs, security vulnerabilities and code smells on programming languages.


2 Answers

There is no direct functionality in 5.2, either built-in or via plugins, to allow this, but it can be accomplished via web serivces, but

  1. You'll have to implement your own Jenkins plugin (or a complicated scripting step) to do it.
  2. In 5.2 the security implications are unattractive. They're better in 5.3

To roll your own

Take a look at the end of your analysis log. You'll see it includes a line like

[INFO] More about the report processing at http://your.sonarqube.server/api/ce/task?id=[guid]

Check the "sonar" directory created during analysis for a report-task.txt file to pick up that guid; it's the ceTaskId value.

In 5.2 If you have global admin perms you can click-through on that link to get the current processing status of the analysis report. In 5.3 you only need execute analysis perms. A "done" report looks like this:

{"task":{"id":"AVExRaJddM_jFJ3_Fp09","type":"REPORT","componentId":"c81cfb77-7bb8-4ea6-ac84-dfee43b43b99","componentKey":"org.apache.asyncweb:asyncweb-parent","componentName":"Apache Asyncweb Parent","componentQualifier":"TRK","status":"SUCCESS","submittedAt":"2015-11-22T23:17:05+0100","submitterLogin":"XXXX","startedAt":"2015-11-22T23:17:07+0100","executedAt":"2015-11-22T23:17:15+0100","executionTimeMs":7677,"logs":true}}

Once you get to status SUCCESS, you could then use web services to query the project's quality gate status.

So it's doable, but in 5.2 only if you want to configure a global-admin-level user's credentials to do it with. In 5.3 it gets better.

Edit for 6.2

6.2 adds webhooks. You can configure up to 10 global and up to 10 project-level URLs to be POSTed to after analysis report processing is complete. The post body is a JSON payload that includes project identifiers, and quality gate status.

like image 159
G. Ann - SonarSource Team Avatar answered Sep 21 '22 07:09

G. Ann - SonarSource Team


A quick workaround, add a post step Execute shell script :

if [ "\`curl -sL -w %{http_code} http://sonar_host/api/qualitygates/project_status?projectKey=project_key -o /dev/null -S --quiet 2>&1 | jsawk -a 'return this.status'\`" == "ERROR" ]; 
then 
  exit 1; 
fi;
like image 40
andolsi zied Avatar answered Sep 21 '22 07:09

andolsi zied