SonarQube 代码扫描任务集成

1. SonarQube 是一种自动代码审查工具，用于检测代码中的错误，漏洞和代码异味。它可以与您现有的工作流程集成，以便在项目分支和拉取请求之间进行连续的代码检查。

2. SonarQube 分为四个模块：SonarQube Server；SonarQube Database ；SonarQube Plugins；分析项目的工具 scanner。

3. SonarQube 总览如图：

4. SonarQube 安装硬件需要满足：SonarQube 服务小型实例需要 2GB RAM；SonarQube 不能在 32-bit 系统下安装。

5. 两个比较重要的能力：

自定义 Rules；设置 Quality Gates，并能通过官方的 API issues 和 Measures History 获取到本次检查结果以及历史数据的统计，便于完成用户自定义代码质量及审核规则定义。

GET http://sonar-host:9000/api/issues/search?componentKeys=project-nanme-ee&types=BUG,CODE_SMELL,VULNERABILITY{"total": 63,"p": 10,"ps": 1,"paging": {"pageIndex": 10,"pageSize": 1,"total": 63},"issues": [{"key": "AWsBeHwrsdaCQfnpVlqY","rule": "javascript:S3531","severity": "MAJOR","component": "project-nanme-ee:utils/auth.js","project": "project-nanme-ee","line": 56,"hash": "ba8f680c2e6e67a758609323f78d6e8e","textRange": {"startLine": 56,"endLine": 56,"startOffset": 0,"endOffset": 38},"flows": [],"status": "OPEN","message": "Add a \"yield\" statement to this generator.","effort": "5min","debt": "5min","author": "lizhen@tenxcloud.com","tags": ["api-design","es2015"],"creationDate": "2018-07-05T09:56:10+0000","updateDate": "2019-05-29T02:35:37+0000","type": "BUG","organization": "default-organization"}],"components": [{"organization": "default-organization","key": "project-nanme-ee","uuid": "AWsBeGQu5qn0Cgv7nKi7","enabled": true,"qualifier": "TRK","name": "project","longName": "project"},{"organization": "default-organization","key": "project-nanme-ee:utils/auth.js","uuid": "AWsBeG-SsdaCQfnpVlWw","enabled": true,"qualifier": "FIL","name": "auth.js","longName": "utils/auth.js","path": "utils/auth.js"}]
}

GET http://localhost:9000/api/measures/search_history?component=project-nanme-ee&metrics=bugs%2Ccode_smells%2Cvulnerabilities%2Creliability_rating%2Csecurity_rating%2Csqale_rating&ps=1000{"paging": {"pageIndex": 1,"pageSize": 1000,"total": 4},"measures": [{"metric": "bugs","history": [{"date": "2019-05-29T02:35:37+0000","value": "63"},{"date": "2019-05-29T03:18:38+0000","value": "63"},{"date": "2019-05-29T03:42:29+0000","value": "63"},{"date": "2019-05-29T04:07:34+0000","value": "63"}]},{"metric": "code_smells","history": [{"date": "2019-05-29T02:35:37+0000","value": "1174"},{"date": "2019-05-29T03:18:38+0000","value": "1174"},{"date": "2019-05-29T03:42:29+0000","value": "1174"},{"date": "2019-05-29T04:07:34+0000","value": "1174"}]},{"metric": "reliability_rating","history": [{"date": "2019-05-29T02:35:37+0000","value": "5.0"},{"date": "2019-05-29T03:18:38+0000","value": "5.0"},{"date": "2019-05-29T03:42:29+0000","value": "5.0"},{"date": "2019-05-29T04:07:34+0000","value": "5.0"}]},{"metric": "security_rating","history": [{"date": "2019-05-29T02:35:37+0000","value": "4.0"},{"date": "2019-05-29T03:18:38+0000","value": "4.0"},{"date": "2019-05-29T03:42:29+0000","value": "4.0"},{"date": "2019-05-29T04:07:34+0000","value": "4.0"}]},{"metric": "sqale_rating","history": [{"date": "2019-05-29T02:35:37+0000","value": "1.0"},{"date": "2019-05-29T03:18:38+0000","value": "1.0"},{"date": "2019-05-29T03:42:29+0000","value": "1.0"},{"date": "2019-05-29T04:07:34+0000","value": "1.0"}]},{"metric": "vulnerabilities","history": [{"date": "2019-05-29T02:35:37+0000","value": "18"},{"date": "2019-05-29T03:18:38+0000","value": "18"},{"date": "2019-05-29T03:42:29+0000","value": "18"},{"date": "2019-05-29T04:07:34+0000","value": "18"}]}]
}

转载于:https://www.cnblogs.com/mykiya/p/10967504.html

SonarQube 代码扫描任务集成相关推荐

sonarQube(代码扫描工具)安装配置
sonarqube使用介绍@[TOC]sonarqube使用介绍 sonarQube使用介绍本文不讲解什么是sonarQube,请自行了解 sonarQube安装 sonarQube分为2个部分 ...
Jenkins+Gitlab+SonarQube 代码质量管理集成
Jenkins+Gitlab+SonarQube 代码质量管理集成一.环境准备 1.1.JDK11环境安装 1.2.Docker环境下搭建SonarQube所需的PostgreSQL数据库 1.2. ...
【sonar集成jenkins实现静态代码扫描】
一 jenkins安装由于公司的jenkins是用于做服务部署,不能够安装集成需要的sonarqube-scanner插件,所以我们需要自己安装一个jenkins,jenkins的安装可以通过hom ...
SonarQube+jenkins-自动化持续代码扫描
SonarQube+jenkins-自动化持续代码扫描 1.SonarQube 1.1 SonarQube介绍 1.1.1 SonarQube 工作流程 1. 2 Docker方式安装SonarQub ...
sonarqube静态扫描代码环境搭建及使用（本地环境）
一.背景目标:在macbook机器本地环境搭建sonarqube服务,并对本地maven项目代码进行静态扫描,将扫描结果提交到sonarqube服务中,并在web页面中展示出来. 静态代码扫描可以发 ...
插件代码_我们开源了一款 SonarQube iOS 代码扫描插件
背景: 我们在公司(好未来)内部开发了一套基于 SonarQube 的静态代码扫描服务,得益于 SonarQube 开源版本本身的功能,我们可以直接复用支持主流的编程语言,但 SonarQube 的开 ...
个推如何管理亿级代码的质量？持续集成SonarQube 代码质量管理系统
2019独角兽企业重金招聘Python工程师标准>>> 平台架构如下图所示,整个代码管理平台由,Analysers, Server , Database 组成. 当然,根据需求不同 ...
sonarqube：java代码扫描
一.概述配置好sonar的服务端后,接下来就要使用sonar检测我们的代码了,sonar主要是借助客户端检测工具来检测代码,所以要使用sonar就需要先在我们本地配置好客户端检测工具. 客户端可以通 ...
SonarQube iOS 代码扫描插件(Objective-C/Swift/Infer/sonar-swift)
仓库地址:https://github.com/tal-tech/sonar-swift 欢迎 Star. 介绍静态代码扫描是一种检测项目代码的方式,能够在不运行代码的情况下对代码进行扫描,可以扫描 ...

SonarQube 代码扫描任务集成

SonarQube 代码扫描任务集成相关推荐

最新文章

热门文章