Gradle or Maven project

Adding the SonarQube Cloud analysis to your Azure build pipeline for Gradle or Maven projects.

The setup is different depending on whether you use YAML or the Azure Classic interface.

• The use of the Classic interface is not always possible (e.g. if your code is stored on GitHub).

• If you use YAML, Sonar can provide you with YAML templates or code examples.

Before you start

Before starting, read Azure Pipelines integration overview.

The prerequisites are:

• The Azure DevOps Extension is installed in your Azure DevOps organization: see Azure DevOps Extension.

• Your project is created in SonarQube Cloud and:

  • Your project binding with you DevOps platform has been configured. See the Configuring Azure DevOps project binding.

  • Your project has been configured for Azure Pipelines. See Configuring project for Azure Pipelines.

• The pull request and branch analysis are enabled in your pipeline.

Analysis parameters can be set at different levels. You must define the project key in the Prepare Analysis Configuration task of your pipeline. You may define additional parameters in this task the same way. In that case, these parameters have precedence over parameters defined at the project or global level.

Using YAML

1. Add the SonarQube analysis run to your build task.

2. Add the following SonarQube’s tasks:

   • Before your build task, add a Prepare Analysis Configuration task.

   • After your build task, add a Run Code Analysis task.

   • After the Rune Code Analysis task, add a Publish Quality Gate Result task.

By default, the scanner version used will be the one specified in your Maven/Gradle build configuration (see the SonarScanner for Maven or SonarScanner for Gradle pages). You can overwrite it by using the sqMavenPluginVersionChoice or sonarQubeGradlePluginVersion input in your pipeline’s Execute build task.

See the YAML file example below. See also our YAML pipeline templates. For information about the SonarQube task inputs, see the List of SonarQube tasks page.

Make sure the SonarQube task version used in your YAML file is the correct one. For example, in SonarCloudPrepare@3, @3 should correspond to the version of the Azure DevOps Extension you’re using.

YAML file example

trigger:
- main # or another name representing your main branch
- feature/*

steps:
 # Checkout the repository
 - checkout: self

 # Disable shallow fetch
  fetchDepth: 0

# Prepare Analysis Configuration task
- task: SonarCloudPrepare@4
  inputs:
    SonarCloud: '<YourSonarQubeServiceEndpoint>'
    organization: '<YourOrganizationName>'
    scannerMode: 'other'
    extraProperties: 'sonar.projectKey=<YourProjectKey>'

# If you use Gradle: add the Execute Gradle build as shown below
- task: Gradle@3
   inputs:
      sonarQubeRunAnalysis: true

# If you use Maven: add the Execute Maven goal as shown below
 - task: Maven@4
      inputs:
      sonarQubeRunAnalysis: true

# Publish Quality Gate Result task
- task: SonarCloudPublish@4
  inputs:
    pollingTimeoutSec: '300'

Using the Classic interface

1. In Azure DevOps’ Classic interface editor, create or update your build pipeline.

2. Add a Prepare Analysis Configuration task before your build task:

• In SonarQube Server Service Endpoint, select the SonarQube service connection you created during setup. See the Configuring project for Azure Pipelines page for more information about adding a connection.

• Under Choose a way to run the analysis, select Integrate with Maven or Gradle.

• Expand the Advanced section and replace the Additional Properties with the following snippet:

# Additional properties that will be passed to the scanner,
# Put one key=value per line, example:
# sonar.exclusions=**/*.bin
sonar.projectKey=YourProjectKey

3. Add a new Maven or Gradle task:

• Under Code Analysis, check Run SonarQube or SonarCloud Analysis.

4. Add a new Publish quality gate result task on your build pipeline summary.

5. Ensure that the pipeline runs automatically for all the branches you want: Under the Triggers tab of your pipeline, select Enable continuous integration and select all the branches for which you want SonarQube Cloud analysis to run automatically.

6. Save your pipeline.

Related pages

• .NET project

• C family project

• JS, TS, Go, Python, PHP, etc. project

• Monorepo projects

• Checking quality gate in release pipeline

• List of SonarQube tasks