SonarQube Community component

The sonarqube component starts the version-matched CI Tools mirror of a built-in SonarQube Community Build service and runs SonarScanner CLI against it. It waits for server-side processing, retrieves the project's findings and active quality-profile rules, and publishes portable artifacts for GitLab and other consumers. Set SONAR_HOST_URL and SONAR_TOKEN to use an existing external server instead.

The component produces:

• sonarqube-<name>-issues.json: native SonarQube issues and security hotspots
• sonarqube-<name>-rules.json: quality profiles and every active rule
• sonarqube-<name>.sarif: SARIF 2.1.0 findings
• sonarqube-<name>-junit.xml: JUnit representation with readable finding details
• gl-sast-report.json: vulnerabilities and security hotspots in GitLab SAST format
• .scannerwork/report-task.txt: SonarScanner server-task metadata

The JUnit report groups findings into suites named after their immediate source directory, such as cloudformation, java, or php. Each test case carries the same suite name as its class name. Its system output uses readable rule, severity, message, location, status, impact, and remediation fields instead of embedding JSON. The SARIF artifact retains the complete native SonarQube finding for machine consumers.

External SonarQube server

The built-in server needs no credentials. To use an external server, create masked CI/CD variables named SONAR_HOST_URL and SONAR_TOKEN, and set the services input to an empty list. The token must have Execute Analysis and Browse permission for the configured project. The component sends the token through the scanner environment and uses bearer authentication for report export; it never places the token on the command line.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/sonarqube@stable
    inputs:
      services: []

Usage

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/sonarqube@stable
    inputs:
      project-key: $CI_PROJECT_PATH_SLUG
      sources: src
      severity: high
      scanner-args:
        - -Dsonar.sourceEncoding=UTF-8

SonarQube Community Build analyzes a single branch and does not support multi-branch analysis. The default job rules run for merge request pipelines and the GitLab default branch, but never for tag pipelines. Use a commercial SonarQube edition when independent branch analysis or merge request decoration is required.

Supported languages

Community Build supports analysis for Ansible, Azure Resource Manager, CloudFormation, Docker, Java, JavaScript, TypeScript, CSS, Kotlin, PHP, Python, Ruby, Rust, Scala, secrets, Terraform, XML, and YAML, among other languages. Some compiled languages require build-specific scanner properties or binaries; for example, Java projects with multiple source files require compiled classes. Consult the SonarQube Community Build language documentation for current versions, prerequisites, and the complete matrix.

The effective analysis coverage is determined by the quality profiles installed on the target instance. The sonarqube-<name>-rules.json artifact records the profiles and complete active rule set used by the server.

Inputs

Input	Default	Description
name	$CI_PROJECT_NAME	Job and report suffix.
project-key	$CI_PROJECT_PATH_SLUG	SonarQube project key.
sources	.	Comma-separated source paths.
host-url	empty	External SonarQube base URL; blank uses the built-in service.
scanner-image	version-matched CI Tools sonar-scanner image	Scanner container image.
scanner-args	[]	Additional scanner properties or arguments.
quality-gate-wait	true	Wait for and enforce the Quality Gate.
quality-gate-timeout	300	Quality Gate timeout in seconds.
severity	high	Minimum finding severity that fails the job and its JUnit case; none keeps all cases green.
stage	test	Pipeline stage.
allow-failure	false	Allow analysis or Quality Gate failure.
services	version-matched CI Tools sonarqube image	Service definition; use [] with an external server.
needs	[]	Job dependencies.
tags	[]	Runner tags.
rules	merge requests and default branch	Job execution rules; tag pipelines are excluded.

Known limitations

• Community Build stores one analyzed branch per project.
• GitLab SAST export contains vulnerabilities and security hotspots; reliability and maintainability findings remain in SARIF, JUnit, and native JSON.
• The Web API evolves between SonarQube releases. The component uses the stable issues, hotspots, profiles, and rules endpoints available in Community Build.

Inputs

Name	Description	Default	Type
---	---	---	---
allow-failure	Allow the pipeline to continue when analysis or the Quality Gate fails.	false	boolean
host-url	SonarQube Community Build base URL. Prefer the masked SONAR_HOST_URL variable.		string
name	Name for the SonarQube job and report files.	$CI_PROJECT_NAME	string
needs	Jobs that this job depends on.	[]	array
project-key	Unique project key in SonarQube Community Build.	$CI_PROJECT_PATH_SLUG	string
quality-gate-timeout	Maximum seconds to wait for the Quality Gate result.	300	number
quality-gate-wait	Wait for and enforce the SonarQube Quality Gate result.	true	boolean
rules	Rules controlling the job. Community Build should analyze one branch at a time.	[{"if":"$CI_PIPELINE_SOURCE == \"merge_request_event\"","when":"on_success"},{"if":"$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH","when":"on_success"},{"when":"never"}]	array
scanner-args	Additional SonarScanner analysis properties or command-line arguments.	[]	array
scanner-image	Version-matched CI Tools SonarScanner CLI image.	${CI_TOOLS_REPO}/sonar-scanner:${CI_TOOLS_COMPONENT_VERSION}	string
services	SonarQube service definition. Set an empty list when using an external server.	[{"name":"${CI_TOOLS_REPO}/sonarqube:${CI_TOOLS_COMPONENT_VERSION}","alias":"sonarqube","variables":{"SONAR_ES_BOOTSTRAP_CHECKS_DISABLE":"true"}}]	array
severity	Minimum finding severity that fails the job. Use none to disable the threshold.	high	string
sources	Comma-separated source paths passed to sonar.sources.	.	string
stage	Pipeline stage for the analysis job.	test	string
tags	Runner tags for the analysis job.	[]	array