SonarLint Connected Mode

SonarLint's Connected Mode connects SonarLint to your SonarQube project and provides additional benefits you won't get by using SonarLint or SonarQube alone.

Shared code quality and security expectations

When using SonarLint, the Sonar way Quality Profile is used by default and users can customize their ruleset. If you're using a different quality profile in SonarQube, new issues might be raised in SonarQube even though your commit looked clean in SonarLint. With Connected Mode, the same customized rule set is applied in both your IDE and in SonarQube, and you're notified in your IDE when your local instance isn't meeting the project's quality gate standards.

More security

When using SonarLint alone, taint analysis issues found by commercial editions of SonarQube aren't raised in SonarLint for performance reasons (we don't want to slow down your editing). In Connected Mode, you'll see the taint analysis issues SonarQube raised in your project. You'll get all of the context in your IDE that you need to triage and fix security problems thereby making sure the code you commit is safe.

Using the Open in IDE feature

When using Connected Mode with SonarLint for IntelliJ or VS Code, it’s possible to use the Open in IDE button to open most all issues in the code editor, speeding up the time it takes to find and fix the issue before running the next analysis. Opening Security hotspots is available for all SonarLint IDEs; check out the SonarQube Issues page and the Opening issues in your IDE article for more details about using this feature. 

SonarLint-SonarQube version support policy

SonarLint enables users to establish a connection to the latest SonarQube version and to the latest LTA (Long-Term Active) version. When a new LTA version is released (approximately every 18 to 24 months), we still enable connecting SonarLint to the previous LTA version for a certain period of time (currently 12 months after the latest LTA release) to allow enough time for organizations to upgrade their SonarQube version. 

For more information about long-term support of SonarQube, check out our page describing "what an LTA is" and, to review IDE-specific requirements, please check the respective pages of the documentation as listed in the next paragraph.

⚠️ The 8.9LTA reached its support expiration date (in November ’23).

Setting up Connected Mode

See the following links for instructions on setting up Connected Mode for each supported IDE:

• SonarLint for IntelliJ
• SonarLint for Visual Studio
• SonarLint for VS Code
• SonarLint for Eclipse

Understanding SonarLint usage

SonarQube administrators can get an overview of SonarLint usage among users by going to Administration > Security > Users. 

The Last SonarLint connection column indicates the last time the user used SonarLint in connected mode.

You can filter users based on their activity. The available options are:

• All users
• Active users with SonarLint: Users that used SonarLint in connected mode at least once in the past 30 days.
• Active users without SonarLint: Users that connected to SonarQube at least once in the past 30 days.
• Inactive users: Users that did not connect to SonarQube or use SonarLint in connected mode in the past 30 days.

Smart notifications

Connected Mode allows SonarQube to send smart alerts to individuals or teams when new issues are discovered. With everyone in the loop, issues can be addressed promptly, improving the overall software quality and delivery. You'll receive smart notifications in your IDE when:

• the quality gate status of a project open in your IDE changes
• a SonarQube analysis raises new issues that you've introduced in a project open in your IDE

You can activate or deactivate smart notifications in SonarLint on the IDE side on a server-by-server basis.

Reviewing issues in your IDE

Seeing an issue directly in the IDE can help you better understand its context. This is the purpose of the Open in IDE button that you'll see as an authenticated user.

This feature is available if you're using a compatible version and flavor of SonarLint. The project must be open in the appropriate IDE and bound to the server through SonarLint's Connected Mode. To set up SonarLint in Connected Mode, please check the SonarLint documentation for your IDE:

• SonarLint for IntelliJ
• SonarLint for Visual Studio
• SonarLint for VS Code
• SonarLint for Eclipse

Keep in mind that the revision or branch analyzed by SonarQube may not be the same as what you have opened in the IDE. In this case, SonarLint will do its best to locate the issue in your local code.

Troubleshooting unexpected analysis results

Observing different analysis results between SonarQube/SonarCloud and SonarLint can have different causes which may or may not be related to Connected Mode:

1. Some issues might be detected by a third party:
   Due to extensive resource requirements, taint vulnerability and some advanced bug detection rules are ignored by SonarLint. Please check the analyzer (PMD, Checkstyle, ESLint, PyLint, …). SonarLint will only run rules from SonarSource analyzers including custom rules extending SonarSource analyzers. Third-party analyzers usually have their own IDE integration, so we have no plan to run them in SonarLint.
2. Your test files might be mistaken as source files:
   Test files can be defined on the server or in the IDE and when running in Connected Mode, these test sources will be used by SonarLint. Each SonarLint flavor has its own way of detecting which file is considered a test file; in SonarLint for IntelliJ, you must define your test files as a Test Sources Root. To define test files on the server, please see the Analysis scope page to set the scope of your analysis.
3. Some complex rules are not run in SonarLint:
   Due to extensive resource requirements, taint vulneralbilitiy and some advanced bug detection rules are ignored by SonarLint. Please check the SonarLint roadmap for a list of features and enhancements on the horizon.
4. Only line-level issues are reported:
   Some rules are able to report issues at the project-level. Such issues, are not displayed in SonarLint, only in SonarQube.
5. When analyzing Java files, the analyzer might need some context for some issues to be found:
   For example, in IntelliJ, there is no incremental compilation of the .class files found in the compiler output folder; these are only produced or refreshed when the project is built. The workaround is to simply build your project with the green hammer (when using IntelliJ) in the top-right toolbar. The project should be building on a regular basic to keep the compiled files up-to-date and overcome this known limitation.