SonarQube is an <a href="https://www.sonarqube.org">open-source platform</a> built by SonarSource for continuous code quality assessment. You can reduce the risks of software development quickly and early on. The most use is that you can obtain automatic code analysis when you need it. Monitor the quality of your codebase with confidence and prevent new bugs from spreading further. Fixing problems earlier in the cycle pays off in the long run.
This is why a lot of mobile development teams have integrated SonarQube checks in their CI/CD pipeline. 
Appcircle can undoubtedly connect to SonarQube during your builds. Here is how:
<h2>Adding SonarQube to your CI/CD Workflows</h2>
<h4>1- Switch to JDK v11</h4>
Java 11 is required for the SonarQube scanners and the SonarQube server. Java versions older than 11 aren&#8217;t officially supported.
If you&#8217;re building for iOS, you can proceed with step 2. Appcircle uses JDK v11 by default on iOS agents. 
For Android version, make sure you run this custom script before adding any SonarQube steps. Go to your workflow, tap edit workflow and drag a custom script to the list.
After saving the workflow, go to the detail of the new custom script step by clicking on it.
In the script part, make sure bash is selected and type these lines into the script text area:
<pre><code class="language-bash"># Change JAVA_HOME to OPENJDK 11 
echo &quot;JAVA_HOME=$JAVA_HOME_11_X64&quot; &gt;&gt; $AC_ENV_FILE_PATH</code></pre>
If everything seems alright, let’s move to the next step.
<h4>2- Install SonarQube CLI script</h4>
First, you have to determine which version of SonarQube you need to install. As of writing this article, if you&#8217;re building for iOS, the latest macOS version link is:
<a href="https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.7.0.2747-macosx.zip">https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.7.0.2747-macosx.zip</a>
And for Android builds, the link is:
<a href="https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.7.0.2747-linux.zip">https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.7.0.2747-linux.zip</a>
Then, add another custom script to your workflow, just like we did above. This script needs to be at where you want SonarQube scanner to work.
The custom script should be in bash, and have the following lines:
<pre><code class="language-bash">export SONAR_SCANNER_VERSION=4.7.0.2747 
export SONAR_TOKEN=xxxxxxxx 
export SONAR_SCANNER_HOME=$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION-macosx 
curl --create-dirs -sSLo $HOME/.sonar/sonar-scanner.zip https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$SONAR_SCANNER_VERSION-macosx.zip 
unzip -o $HOME/.sonar/sonar-scanner.zip -d $HOME/.sonar/ 
export PATH=$SONAR_SCANNER_HOME/bin:$PATH 
export SONAR_SCANNER_OPTS=&quot;-server&quot; 
sonar-scanner \ 
-Dsonar.organization=YOUR_ORGANIZATION \ 
-Dsonar.projectKey=YOUR_PROJECT_KEY \ 
-Dsonar.sources=. \ 
-Dsonar.c.file.suffixes=- \ 
-Dsonar.cpp.file.suffixes=- \ 
-Dsonar.objc.file.suffixes=- \ 
-Dsonar.host.url=SONARQUBE_URL</code></pre>
To get a grasp of the arguments we passed to our scanner CLI, here are all the options available:
usage: sonar-scanner [options]
Options: 
-D,&#8211;define Define property 
-h,&#8211;help Display help information 
-v,&#8211;version Display version information 
-X,&#8211;debug Produce execution debug output
<h4>3- Enable Verbose Logging (Optional)</h4>
You can add one of the following to your custom script if you require extra debug information:
<pre><code class="language-bash">-Dsonar.verbose=true</code></pre>
<h4>4- Add Credentials as Environment Variables</h4>
SonarQube includes user authentication by default. You can disable compulsory user authentication in your account and enable anonymous users to explore projects and execute analyses.
Make sure to fill all the variables correctly while entering the script. Save them as Environment Variables on Appcircle. You can get more information about environment variables here: <a href="https://docs.appcircle.io/environment-variables/why-to-use-environment-variables-and-secrets">https://docs.appcircle.io/environment-variables/why-to-use-environment-variables-and-secrets</a>
We&#8217;re all set! Go to the Build Profile and initiate a manual build or trigger a build using <a href="https://docs.appcircle.io/build/build-manually-or-with-triggers/">triggers</a>.
You can add as many environment variables as you need in Appcircle.
<h3>Where to Go From Here</h3>
So far we&#8217;ve added SonarQube in a simple-ish way. To learn more about SonarQube and it&#8217;s capabilities, visit their <a href="https://docs.sonarqube.org/latest/">docs</a>.
If you would like us to consider adding SonarQube as a drag and drop workflow step or any other step <a href="https://appcircle.io/support/">let us know</a>.
Send us any question and we&#8217;ll assist you. SonarQube integration with Appcircle is simple, and we highly recommend you to use it for your further application development plans.
Happy coding!

How to Integrate Sonarqube into your CI/CD Workflow

Related Posts

Comparing Appcircle and Bitrise: Which DevOps Tool Builds Faster?

Why do you need a dedicated CI/CD Platform instead of Using Jenkins for Mobile Apps?

Isolation as Key: Optimizing Performance in Concurrent Builds on a Single Host

Measuring Mobile DevOps Maturity with DORA Metrics

How to Integrate Sonarqube into your CI/CD Workflow

Related Posts

Comparing Appcircle and Bitrise: Which DevOps Tool Builds Faster?

Why do you need a dedicated CI/CD Platform instead of Using Jenkins for Mobile Apps?

Isolation as Key: Optimizing Performance in Concurrent Builds on a Single Host

Measuring Mobile DevOps Maturity with DORA Metrics

Subscribe to Appcircle Circle