Set up SonarQube branch analysis with pull request decoration for enhanced code quality workflows

Install SonarQube Developer Edition

Branch analysis requires SonarQube Developer Edition or higher. Download and install the commercial edition with branch analysis capabilities.

cd /opt
sudo wget https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-10.3.0.82913.zip
sudo unzip sonarqube-10.3.0.82913.zip
sudo mv sonarqube-10.3.0.82913 sonarqube
sudo chown -R sonar:sonar /opt/sonarqube

Configure branch analysis in sonar.properties

Enable branch analysis and configure the branch plugin settings in the SonarQube configuration file.

# Enable branch analysis
sonar.branch.name=main
sonar.branch.target=main

Pull request analysis configuration
sonar.pullrequest.provider=github
sonar.pullrequest.github.repository=your-org/your-repo
sonar.pullrequest.github.endpoint=https://api.github.com/

Database configuration (required for branch data storage)
sonar.jdbc.url=jdbc:postgresql://localhost:5432/sonarqube
sonar.jdbc.username=sonarqube
sonar.jdbc.password=your_secure_password

Web server configuration
sonar.web.host=0.0.0.0
sonar.web.port=9000
sonar.web.javaOpts=-Xmx2048m -Xms1024m

Install and configure branch plugin

The branch analysis functionality is built into Developer Edition. Restart SonarQube to enable the features.

sudo systemctl restart sonarqube
sudo systemctl status sonarqube

Check logs for branch plugin initialization
sudo tail -f /opt/sonarqube/logs/sonar.log

Create GitHub App for pull request decoration

Generate a GitHub App to enable SonarQube to comment on pull requests and update commit statuses.

# Generate private key for GitHub App
openssl genpkey -algorithm RSA -out /opt/sonarqube/conf/github-app-key.pem -pkcs8 -out_len 2048
sudo chown sonar:sonar /opt/sonarqube/conf/github-app-key.pem
sudo chmod 600 /opt/sonarqube/conf/github-app-key.pem

Configure GitHub integration in SonarQube

Set up the GitHub App credentials in SonarQube administration panel for pull request decoration.

Navigate to Administration > Configuration > General Settings > Pull Requests and configure:

• Provider: GitHub
• GitHub App ID: Your app ID from GitHub
• Client ID: Your app client ID
• Client Secret: Your app client secret
• Private Key: Contents of github-app-key.pem
• GitHub URL: https://api.github.com/ (for GitHub.com)

Configure GitLab integration

For GitLab projects, configure the GitLab integration settings in SonarQube.

# GitLab configuration (alternative to GitHub)
sonar.pullrequest.provider=gitlab
sonar.pullrequest.gitlab.url=https://gitlab.com
sonar.pullrequest.gitlab.userToken=your_gitlab_token

Project-specific GitLab settings
sonar.pullrequest.gitlab.projectId=12345
sonar.pullrequest.gitlab.projectUrl=https://gitlab.com/your-group/your-project

Configure webhook for real-time updates

Set up webhooks in your Git provider to trigger SonarQube analysis on pull request events.

# Webhook URL: http://your-sonarqube-server:9000/api/alm_integration/github/provisioning
Content type: application/json
Events: Pull requests, Push
Secret: Configure in SonarQube webhook settings

Create project with branch analysis enabled

Set up a new project in SonarQube with branch analysis and pull request decoration enabled.

# Create project via API
curl -u admin:admin_password -X POST "http://localhost:9000/api/projects/create" \
  -d "project=my-project" \
  -d "name=My Project" \
  -d "mainBranch=main"

Configure project for GitHub integration
curl -u admin:admin_password -X PUT "http://localhost:9000/api/alm_settings/set_github_binding" \
  -d "project=my-project" \
  -d "almSetting=github-config" \
  -d "repository=your-org/your-repo"

Configure CI/CD pipeline for branch analysis

Set up your CI/CD pipeline to run SonarQube analysis with branch and pull request parameters.

name: SonarQube Analysis
on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    
    - name: SonarQube Scan
      uses: sonarqube-quality-gate-action@master
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
      with:
        args: >
          -Dsonar.projectKey=my-project
          -Dsonar.sources=src
          -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
          -Dsonar.pullrequest.branch=${{ github.head_ref }}
          -Dsonar.pullrequest.base=${{ github.base_ref }}

Configure GitLab CI pipeline

Set up GitLab CI pipeline with SonarQube scanner for merge request analysis.

stages:
  - analysis

sonarqube-check:
  stage: analysis
  image: 
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    GIT_DEPTH: "0"
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  script: 
    - sonar-scanner
      -Dsonar.projectKey=my-project
      -Dsonar.sources=src
      -Dsonar.host.url=$SONAR_HOST_URL
      -Dsonar.login=$SONAR_TOKEN
      -Dsonar.pullrequest.key=$CI_MERGE_REQUEST_IID
      -Dsonar.pullrequest.branch=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
      -Dsonar.pullrequest.base=$CI_MERGE_REQUEST_TARGET_BRANCH_NAME
  only:
    - merge_requests
    - main
    - develop

Configure quality gates for branches

Set up branch-specific quality gates and configure pull request decoration rules.

# Create custom quality gate for pull requests
curl -u admin:admin_password -X POST "http://localhost:9000/api/qualitygates/create" \
  -d "name=PR Gate"

Add conditions to quality gate
curl -u admin:admin_password -X POST "http://localhost:9000/api/qualitygates/create_condition" \
  -d "gateName=PR Gate" \
  -d "metric=new_coverage" \
  -d "op=LT" \
  -d "error=80"

curl -u admin:admin_password -X POST "http://localhost:9000/api/qualitygates/create_condition" \
  -d "gateName=PR Gate" \
  -d "metric=new_bugs" \
  -d "op=GT" \
  -d "error=0"

Enable pull request decoration

Configure SonarQube to automatically decorate pull requests with quality gate results and code coverage.

Navigate to Administration > Configuration > General Settings > Pull Requests and enable:

• Decorate Pull Requests: Yes
• Delete comments on resolved issues: Yes
• Provider-specific webhook secret