How to Integrate SonarQube With Jenkins

in this video we're going to talk about how to integrate sonar cube with jenkins [Music] you may already be using one of the x unit frameworks in your jenkins pipelines to test your code such as junit or n unit but now your organization wants a central way to run and verify all of the tests and guess what tag you're it you have now been selected to run a proof concept using jenkins and sonarcube here's today's starting point i have a jenkins lts controller version 2.289.3 when it was installed it was installed using install suggested plugins to this controller i have an agent attached i also have a standalone sonar cube server and finally there's a sample repository that we're using today to work through our examples there is a link to adjust down in the description that has all of the information about today's video so the first thing that we're going to do is we are going to install a plugin to interact with sonarcube the plugin isn't necessary but it makes your life much easier in doing the integrations and it also adds a feature that will be a lot harder for you to implement so let's go to manage jenkins we will go to manage plugins go to available and type sonar and the plug-in that we want is sonar cube scanner as of recording the version is 2.13.1 we'll click on check box download now and install after restart once it's downloaded we will do the restart okay now we're back let's log in and let's verify that the plugin is actually installed so we'll go to manage plugins one more time click on installed and type sonar again we can see that sonar cube scanner for jenkins is installed now that we have the plugin installed let's go configure it the way we do that is we go to manage jenkins configure system let's scroll down to the sonar cube section now the very first thing that we see here is environment variables checkbox let's go ahead and check that checkbox let's add a sonar cube server i'm going to give it a name and the name i'm going to give it is sq1 you can just give it any kind of name that you want but it's a name my url is copying from here 192 168 1 230 and port 9000 by default the sonar cube server listens on port 9000. now you'll also notice that there is a server authentication token at this point we have not logged into sonarcube yet to create that token so let's go do that now so let's go over to our sonar server we're going to click on administration we are going to click on security and then we are going to go to users and i have a local user named administrator or admin and i want to add a token just to this user so i'm going to go over here to the tokens column i'm going to click on update tokens i'm going to generate a token name i'm just going to call it jenkins doesn't really matter the name and i'm going to click on generate and now i have this token shown to me so i'm going to copy this okay let's head back over to jenkins and let's create that credential so we'll say add jenkins this is going to be a secret text type credential the secret is what i have in my buffer the id i'm just going to call it jenkins sonar and that's good enough then we will select it and now we want to click on save now let's go ahead and create a test job and see what happens we'll say new item i'm going to call this sonar select pipeline click ok and then pipeline script from scm get now let's go take a look at our repository which we haven't looked at yet so it's on github it's a public repository under my organization darin pope and the java dash web dash app now note that we are working on the sonar branch right now so taking a look at this we have a jenkinsfile1 and a jenkins file 2. let's take a look at jenkins file 1 first we can see here that we're going to be using this step called with sonar cube env and the installation name is sq1 remember when we set up our sonar cube configuration we named it sq1 so this is where the sq1 is being used and then within that we're just saying maven w clean and then we're making a call using the sonar maven plugin sonar so if i had the sonar plugin already installed with my version of maven then i could have just said clean sonar sonar but since i'm bringing this in on the fly i wanted a specific version of this maven sonar plugin so i'm fully qualifying the plugin and its version okay so let's go back up and grab our link go back over to our job paste it in we are working on the sonar branch and then jenkinsfile-1 that's the first one that we're going to do click on save now let's click on build now let's watch build 1. so it's injecting sonar cube environment variables let's get back to that injecting sonar cube environment variables using the configuration sq1 remember that checkbox that we added at the very beginning where we did the checkbox for environment variables this is why this message shows up in the build log it's going to scroll down a little bit more we are building from the internet so it takes a little bit longer okay now here we go when we actually run the sonar goal within maven we can see that it's making the call against the sonar cube version 901 that's the version of the sonar server we have running then all of this output is happening with sonar so we can see here at the very end everything was successful it took about eight seconds 7.7 seconds to be exact and then it completed well let's take a look at our sonar server now because if you remember when we first came over there were just a bunch of blocks and nothing had been set up let's click on sonar cube and what we see now is demo is here if we click into demo we can see that there was one security hotspot 10 minutes of debt one code smell and everything passed so this is good this is what we wanted is now we can come over into sonar and take a look at our demo project they have them defined as projects and we can take a quick look and understand what's going on within our project now let's think back to our jenkins file we did a maven clean sonar colon sonar yes it was a little bit longer but effectively that's what it was but that was basically just a firing forget to sonar what if we wanted to wait within our jenkins file before moving on to maybe another step afterwards but we wanted to make sure that a quality gate was passed within sonar the sonar plug-in gives us a step for that but we have to make one more configuration change within sonar to take advantage of that step and that configuration is a web hook so let's go back over into administration we are going to go to configuration and we're going to go to web hooks we're going to create a web hook i'm going to give it a name of jenkins the url is going to be copying it here it's going to be my jenkins server which in my case is jenkins colon 8080 and the sonar plugin on jenkins exposes a web hook called sonarcube dash webhook and i'm not going to supply a secret let's go ahead and click on create so as the project analysis completes it's going to send a web hook back to our jenkins server so we can continue on doing whatever it is that we're doing within our pipeline in our jenkins file dash 1 pipeline we just ran maven clean sonar sonar and that was it we didn't care but we're getting ready to take a look at a different jenkins file for this next example so let's go up to our repository and let's take a look at jenkinsfile 2. we can see here that we've got a two minute timeout and we're going to wait for the quality gate and if the quality gate does not pass now this is not a video about sonar so i'm going to leave it up to you to do research and understand how you set up quality gates within sonar but what i want to show you is i'm setting up a timeout for two minutes that means i'm going to give sonar two minutes to either pass or fail based on the quality gate if for some reason it comes back with a failing quality gate this pipeline is going to abort or if it passes it's going to just succeed and then complete so let's go over back to our job and change our configuration from dash 1 to dash 2. click on save and then build now they will track what's going on in two so we're doing our maven scan right now passed all of that information over and then we can see here that it was checking on the status it was in progress and then it was in a status of success and then it completed and finally the quality gate is okay so therefore the pipeline finished successfully so why should you integrate sonar cube with jenkins as we've already seen sonarcube is an open source platform for continuous code quality monitoring among the many things that it does it helps developers and testers find outdated dependencies security vulnerabilities and bad coding practices by integrating sonar cube with jenkins we can automate the sonar cube processes to ensure that all of the code is inspected the result is a higher quality code base because we have a safety net in place to catch any problems before they become production issues if you have any questions or comments you can reach out to us on twitter at cloudbeesdevs if this video was helpful to you give us a thumbs up and if you haven't subscribed to cloudbees tv yet why not take a moment click on that subscribe button and then ring that bell and you'll be notified anytime there's new content available on cloudbees tv thanks for watching and we will see you in the next video you

Channel: CloudBeesTV

Views: 3,053

Keywords: darin pope, jenkins, jenkins tutorial, sonarqube, sonarqube integration with jenkins, sonarqube integration with jenkins pipeline, sonarqube jenkins integration, sonarqube jenkins pipeline, how to configure sonarqube in jenkins, how to setup sonarqube in jenkins, how to use sonarqube with jenkins, sonarqube jenkins, jenkins sonarqube plugin, sonarqube setup in jenkins, sonarqube configuration in jenkins pipeline

Id: KsTMy0920go

Length: 12min 42sec (762 seconds)

Published: Tue Aug 24 2021