SonarScanner for Maven

The SonarScanner for Maven is recommended as the default scanner for Maven projects.

The ability to execute the SonarQube analysis via a regular Maven goal makes it available anywhere Maven is available (developer build, CI server, etc.), without the need to manually download, set up, and maintain a SonarQube scanner installation. The Maven build already has much of the information needed for SonarQube to successfully analyze a project. By preconfiguring the analysis based on that information, the need for manual configuration is reduced significantly.

Prerequisites

• Maven 3.2.5+
• At least the minimal version of Java supported by your SonarQube server is in use

Edit the settings.xml file, located in <MAVEN_HOME>/conf or ~/.m2, to set the plugin prefix and optionally the SonarQube server URL.

Global settings

Example:

<settings>
    <pluginGroups>
        <pluginGroup>org.sonarsource.scanner.maven</pluginGroup>
    </pluginGroups>
    <profiles>
        <profile>
            <id>sonar</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <properties>
                <!-- Optional URL to server. Default value is http://localhost:9000 -->
                <sonar.host.url>
                  http://myserver:9000
                </sonar.host.url>
            </properties>
        </profile>
     </profiles>
</settings>

Analyzing

Analyzing a Maven project consists of running a Maven goal: sonar:sonar from the directory that holds the main project pom.xml. You need to pass an authentication token using one of the following options: 

• Use the sonar.token property. For example, to set it through the command line, Execute maven sonar:sonar -Dsonar.token=yourAuthenticationToken and wait until the build has completed, then open the web page indicated at the bottom of the console output. You should now be able to browse the analysis results.
• Create the SONAR_TOKEN environment variable and set the token as its value.

mvn clean verify sonar:sonar -Dsonar.token=myAuthenticationToken

In some situations you may want to run the sonar:sonar goal as a dedicated step. Be sure to use install as first step for multi-module projects

mvn clean install
mvn sonar:sonar -Dsonar.token=myAuthenticationToken

To specify the version of sonar-maven-plugin instead of using the latest:

mvn org.sonarsource.scanner.maven:sonar-maven-plugin:3.7.0.1746:sonar

To get coverage information, you'll need to generate the coverage report before the analysis and specify the location of the resulting report in an analysis parameter. See test coverage for details.

Configuring analysis

Most analysis properties will be read from your project. If you would like to override the default values of specific additional parameters, configure the parameter names found on the analysis parameters page in the <properties> section of your pom.xml like this:

<properties>
  <sonar.buildString> [...] </sonar.buildString>
</properties>

Sample project

To help you get started, a simple project sample is available here: https://github.com/SonarSource/sonar-scanning-examples/tree/master/sonar-scanner-maven/maven-basic

Excluding a module from analysis

• define property <sonar.skip>true</sonar.skip> in the pom.xml of the module you want to exclude
• use build profiles to exclude some modules (like for integration tests)
• use Advanced Reactor Options (such as "-pl"). For example mvn sonar:sonar -pl !module2

How to fix version of Maven plugin

It is recommended to lock down versions of Maven plugins:

<build>
  <pluginManagement>
    <plugins>
      <plugin>
        <groupId>org.sonarsource.scanner.maven</groupId>
        <artifactId>sonar-maven-plugin</artifactId>
        <version>3.7.0.1746</version>
      </plugin>
    </plugins>
  </pluginManagement>
</build>

Troubleshooting

If you get a java.lang.OutOfMemoryError

Set the MAVEN_OPTS environment variable, like this in Unix environments:

export MAVEN_OPTS="-Xmx512m"

In Windows environments, avoid the double quotes, since they get misinterpreted.

set MAVEN_OPTS=-Xmx512m