Generic issue import format
SonarQube supports a generic import format for raising external issues in code. You can use this format to import issues from your favorite linter even if there's no plugin for it. SonarQube also supports many third-party issue report formats, see importing third-party issues for more information.
There are a couple of limitations with importing external issues:
- You can't manage them within SonarQube. For instance, there is no ability to mark them as false positives.
- You can't manage the activation of the rules that raise these issues within SonarQube. External rules aren't visible on the Rules page or reflected in quality profiles.
External issues and the rules that raise them must be managed in the configuration of your linter.
The analysis parameter
sonar.externalIssuesReportPaths accepts a comma-delimited list of paths to reports.
Each report must contain, at the top level, an array of
Issue objects named
primaryLocation- Location object
type- String. One of BUG, VULNERABILITY, CODE_SMELL
severity- String. One of BLOCKER, CRITICAL, MAJOR, MINOR, INFO
effortMinutes- Integer, optional. Defaults to 0
secondaryLocations- Array of Location objects, optional
textRange- TextRange object, optional for secondary locations only
startLine- Integer. 1-indexed
endLine- Integer, optional. 1-indexed
startColumn- Integer, optional. 0-indexed
endColumn- Integer, optional. 0-indexed
Here is an example of the expected format: