Importing third-party issues
This page lists analysis parameters related to the import of issues raised by external, third-party analyzers. If your analyzer isn't on this page, see the generic issue import format for a generic way to import external issues. You can also import issues from SARIF reports.
SonarQube doesn't run your external analyzers or generate reports. It only imports pre-generated reports. Below you'll find language- and tool-specific analysis parameters for importing reports generated by external analyzers.
Some properties support the following wildcards in paths. The remarks for properties that support wildcards will mention that fact. If the remarks do not say wildcards are supported, then they are not.:
|a single character|
|any number of characters|
|any number of directories|
Unless otherwise specified, the following properties accept both absolute paths and paths relative to the project root.
|Apex||Comma-delimited list of paths to PMD Apex|
|Cloudformation||Comma-delimited list of paths to AWS CloudFormation Linter reports in JSON format|
|C/C++/Objective-C||Comma-delimited list of paths to Valgrind Memcheck and Helgrind XML reports|
|CSS||Comma-delimited list of paths to StyleLint.io reports|
|Docker||Comma-delimited list of paths to Hadolint reports in JSON and `sonarqube` format|
|Go||Comma-delimited list of paths to GoVet reports|
|Go||Comma-delimited list of paths to GoLint reports|
|Go||Comma-delimited list of paths to GoMetaLinter reports|
|Go||Comma-delimited list of paths to golangci-lint reports in checkstyle format (use |
Depending on how many issues you're importing, you might want to disable the
|Go||Comma-delimited list of paths to gosec reports in SonarQube format (use |
|Java||Comma-delimited list of paths to reports from SpotBugs, FindSecBugs, or FindBugs|
|Java||Comma-delimited list of paths to reports from PMD|
|Java||Comma-delimited list of paths to reports from Checkstyle|
|Kotlin||Comma-delimited list of paths to AndroidLint reports|
|Kotlin||Comma-delimited list of paths to Detekt reports|
|Kotlin||Comma-delimited list of paths to Ktlint reports|
|PHP||Comma-delimited list of paths to Psalm reports. Reports should be generated in the Generic Issue Format (run Psalm with the option |
|PHP||Comma-delimited list of paths to PHPStan reports. Reports should be generated in the PHPStan JSON Output Format (use the PHPStan |
|Python||Comma-delimited list of paths to Pylint reports (use |
|Python||Comma-delimited list of paths to Bandit reports|
|Python||Comma-delimited list of paths to Flake8 reports|
|Python||Comma-delimited list of paths to Mypy reports|
|Python||Comma-delimited list of paths to Ruff reports.|
|Ruby||Comma-delimited list of paths to Rubocop reports|
|Scala||Comma-delimited list of paths to Scalastyle reports|
|Scala||Comma-delimited list of paths to Scapegoat reports in the Scalastyle format|
|Swift||Comma-delimited list of paths to SwiftLint reports in JSON format|
|Terraform||Comma-delimited list of paths to TFLint reports in JSON format|
|TypeScript||Comma-delimited list of paths to TSLint reports in JSON format (use |
Issues from third-party Roslyn analyzers (including Roslyn analyzers provided by Microsoft) are included in the MSBuild output and imported by default into SonarQube therefore, no properties exist to enable that behavior. Instead, properties are available to adjust the import and to stop importing those issues.
|C#||Set to |
|C#||Comma-delimited list of categories whose issues should be classified as Bugs, Vulnerabilities, or Code Smells.|
|VB.NET||Set to |
|VB.NET||Comma-delimited list of categories whose issues should be classified as Bugs, Vulnerabilities, or Code Smells.|
Note that Roslyn issues with an error severity automatically fail the build. We don't recommend running the Scanner for MSBuild's end step if the MSBuild step fails for any reason because it will result in an essentially empty analysis.
External issues have two important limitations:
- They cannot be managed within SonarQube; for instance, there is no ability to mark them as false positives.
- The activation of the rules that raise these issues cannot be managed within SonarQube. External rules are not visible on the Rules page or reflected in any quality profile.
© 2008-2023, SonarSource S.A, Switzerland. Except where otherwise noted, content in this space is licensed under a Creative Commons Attribution-NonCommercial 3.0 United States License. SONARQUBE is a trademark of SonarSource SA. All other trademarks and copyrights are the property of their respective owners.