Sonar for Bitbucket never triggers a SonarQube analysis. The most common scenario is an integration of the SonarQube analysis into your build pipeline.
A recommended flow with Sonar for Bitbucket looks like:
New code changes pushed to Bitbucket (or new pull request is created)
Bitbucket triggers your build pipeline for code changes
Your build pipeline must trigger the Sonar analysis
and executes the SonarScanner or one of its build system-dependent alternatives.
see below for required parameters
SonarQube informs Sonar for Bitbucket over a Webhook about a new analysis report.
Sonar for Bitbucket annotates existing pull requests with the issues found in the analysis.
Whichever external system you use to execute the Sonar scan, you need to run it with the correct parameters for your SonarQube application. Use the analysis parameter matrix below to find yours.
Analysis Parameter Matrix
The table shows the minimally necessary parameters to get Sonar for Bitbucket to work with SonarScanner. Look at the SonarQube documentation for additional parameters or different scanning methods.
Developer Edition or higher | Community Edition | SonarCloud | |
|---|---|---|---|
Common Parameters | sonar-scanner \ -Dsonar.projectKey=<SONAR_PROJECT_KEY> \ -Dsonar.host.url=<SONAR_SERVER_URL> | sonar-scanner \ -Dsonar.projectKey=<SONAR_PROJECT_KEY_PREFIX:BRANCH_NAME> \ -Dsonar.host.url=<SONAR_SERVER_URL> SonarQube versions 7.9.x and 8.x only allow certain characters Use the same character as configured in the SonarQube server configuration under ‘Branch renaming for Sonar Project Keys’. To replace illegal characters with the replacement character, the following sed expression can be used in your CI/CD configuration:
| sonar-scanner \ -Dsonar.projectKey=<SONAR_PROJECT_KEY> \ -Dsonar.host.url=https://sonarcloud.io \ -Dsonar.organization=<SONAR_CLOUD_ORGANIZATION> |
Branch Analysis | -Dsonar.branch.name=<branch_name> | Parameter not supported, branch included in sonar project key as | See Developer Edition or higher |
Pull Request Analysis | -Dsonar.pullrequests.key=<pull request identifier from Bitbucket> -Dsonar.pullrequest.branch=<source branch name of pull request> -Dsonar.pullrequest.base=<destination branch name of pull request> See: https://docs.sonarqube.org/latest/analysis/pull-request/ | Take the source branch name of pull requests for | See Developer Edition or higher |
Only SonarQube 7.7 | -Dsonar.analysis.scmRevision=COMMIT_ID | -Dsonar.analysis.scmRevision=COMMIT_ID | Not needed |
Build Systems
Bamboo
We provide a first class integration for Bamboo with our Sonar for Bamboo plugin. See our dedicated wiki page for more information.
Jenkins
Use Bitbucket Webhook to Jenkins or any other app to notify Jenkins about new code changes. See these instructions on how to set it up. It is important enabling the setting "Omit SHA1 Hash Code" in the repository settings of the app (see this issue on Github for more details).
Follow the instructions on the Sonar Scanner for Jenkins Wiki to set up the SonarScanner configuration.
The Jenkins Git plugin includes the
origin/prefix in branch names, which has to be removed. Use a Jenkins freestyle job.echo SONAR_BRANCH=$(printf '%s' $GIT_BRANCH | cut -d'/' -f 2-) > sonar-branch
(Community Edition only) SonarQube versions 7.9.x and 8.x need to replace illegal branch characters.
Use the following command to export the sanitized branch name to a file:echo SONAR_BRANCH=$(printf '%s' $GIT_BRANCH | cut -d'/' -f 2- | sed s/[^0-9a-zA-Z:_.\-]/'<YOUR_CONFIGURED_CHAR>'/g) > sonar-branch
To inject the environment variable from the file sonar-branch , you also need to install the Jenkins EnvInject Plugin.
You can then use this environment variable to trigger the Sonar analysis with -Dsonar.projectKey=<SONAR_PROJECT_KEY_PREFIX>:$SONAR_BRANCH
Problems During Setup
We at Mibex Software are happy to help you in our support desk or at support@mibexsoftware.com