Baike.dev
All toolsAI codingTrendingOpen sourceNewsSubmit
Log in
< Back to tools
S

sonar-gitlab-plugin

> 开发工具
Open source

Add to each commit GitLab in a global commentary on the new anomalies added by this commit and add comment lines of modified files

725 stars0 likes0 views
WebsiteGitHub

About

Add to each commit GitLab in a global commentary on the new anomalies added by this commit and add comment lines of modified files

Sonar GitLab Plugin

Inspired by https://github.com/SonarCommunity/sonar-github

Current version

Version 4.1.0-SNAPSHOT

**Only SonarQube Others versions, go to ChangeLog section

Goal

Add to each commit GitLab in a global commentary on the new anomalies added by this commit and add comment lines of modified files.

Comment commits:

Comment line:

Add build line:

With quality gate global comment

With generate code quality json file

With generate SAST json file

Works with Java, Php, Android, JavaScript, C#, etc..

Usage

For SonarQube = 5.4 and = 5.6 and = 6.7 and = 7.0:

  • Download last version https://github.com/gabrie-allaigre/sonar-gitlab-plugin/releases/download/4.0.0/sonar-gitlab-plugin-4.0.0.jar
  • Copy file in extensions directory SONARQUBE_HOME/extensions/plugins
  • Restart SonarQube

Optional Plugin: Add Single Sign-On with GitLab in SonarQube

Command line

Example:

Issues mode (Preview)

With Maven

mvn --batch-mode verify sonar:sonar -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.analysis.mode=preview -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID

or for comment inline in all commits of branch:

mvn --batch-mode verify sonar:sonar -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.analysis.mode=preview -Dsonar.gitlab.commit_sha=$(git log --pretty=format:%H origin/master..$CI_COMMIT_SHA | tr '\n' ',') -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID -Dsonar.gitlab.unique_issue_per_inline=true

With SonarScanner

sonar-scanner -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.analysis.mode=preview -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID

With SonarScanner and node

npm run sonar-scanner -- -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.analysis.mode=preview -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID

With Gradle

./gradlew sonarqube -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.analysis.mode=preview -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID

Publish mode (Analyse)

With Maven

mvn --batch-mode verify sonar:sonar -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID -Dsonar.branch.name=$CI_COMMIT_REF_NAME

Works with sonar-scanner and gradle

GitLab CI

Set secret variable SONAR_URL and SONAR_LOGIN

.gitlab-ci.yml sample for Maven project, comment last commit:

sonarqube_master_job:
  stage: test
  only:
    - master
  script:
    - mvn --batch-mode verify sonar:sonar -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN

sonarqube_preview_feature_job:
  stage: test
  only:
    - /^feature\/*/
  script:
    - git checkout origin/master
    - git merge $CI_COMMIT_SHA --no-commit --no-ff
    - mvn --batch-mode verify sonar:sonar -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_LOGIN -Dsonar.analysis.mode=preview -Dsonar.gitlab.project_id=$CI_PROJECT_PATH -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME

With quality gate

…

If use SonarQube with BranchPlugin

…

For get code quality (codeclimate.json) in merge request (only GitLab EE https://docs.gitlab.com/ee/user/project/merge_requests/code_quality_diff.html)

Warning, master must have a codequality.json, use commit-status for notification mode (not mandatory)

…

For get SAST (gl-sast-report.json) information in merge request (only GitLab EE https://docs.gitlab.com/ee/user/project/merge_requests/sast.html)

…

To enable discussions instead of comments

NOTE: This CI variable CI_MERGE_REQUEST_IID is available from version 11.6 on.

mvn --batch-mode verify sonar:sonar \
    -Dsonar.host.url=$SONAR_URL
    -Dsonar.login=$SONAR_LOGIN \
    -Dsonar.analysis.mode=preview \
    -Dsonar.gitlab.api_version=v4 \
    -Dsonar.gitlab.project_id=$CI_PROJECT_PATH \
    -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA \
    -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME \
    -Dsonar.gitlab.user_token= \
    -Dsonar.gitlab.url=http:// \
    -Dsonar.gitlab.ci_merge_request_iid=$CI_MERGE_REQUEST_IID \
    -Dsonar.gitlab.merge_request_discussion=true
GitLab 8.x name GitLab 9.x name
CI_BUILD_REF CI_COMMIT_SHA
CI_BUILD_REF_NAME CI_COMMIT_REF_NAME

https://docs.gitlab.com/ce/ci/variables/#9-0-renaming

Plugins properties

Variable Comment Type Version
sonar.gitlab.url GitLab url Administration, Variable >= 1.6.6
sonar.gitlab.max_global_issues Maximum number of anomalies to be displayed in the global comment Administration, Variable >= 1.6.6
sonar.gitlab.user_token Token of the user who can make reports on the project, either global or per project Administration, Project, Variable >= 1.6.6
sonar.gitlab.project_id Project ID in GitLab or internal id or namespace + name or namespace + path or url http or ssh url or url or web Project, Variable >= 1.6.6
sonar.gitlab.commit_sha SHA of the commit comment Variable >= 1.6.6
sonar.gitlab.ref Branch name or reference of the commit Variable = 1.6.6
sonar.gitlab.max_blocker_issues_gate Max blocker issue for build failed (default 0). Note: only for preview mode Project, Variable >= 2.0.0
sonar.gitlab.max_critical_issues_gate Max critical issues for build failed (default 0). Note: only for preview mode Project, Variable >= 2.0.0
sonar.gitlab.max_major_issues_gate Max major issues for build failed (default -1 no fail). Note: only for preview mode Project, Variable >= 2.0.0
sonar.gitlab.max_minor_issues_gate Max minor issues for build failed (default -1 no fail). Note: only for preview mode Project, Variable >= 2.0.0
sonar.gitlab.max_info_issues_gate Max info issues for build failed (default -1 no fail). Note: only for preview mode Project, Variable >= 2.0.0
sonar.gitlab.ignore_certificate Ignore Certificate for access GitLab, use for auto-signing cert (default false) Administration, Variable >= 2.0.0
sonar.gitlab.comment_no_issue Add a comment even when there is no new issue (default false) Administration, Variable >= 2.0.0
sonar.gitlab.disable_inline_comments Disable issue reporting as inline comments (default false) Administration, Variable >= 2.0.0
sonar.gitlab.only_issue_from_commit_file Show issue for commit file only (default false) Variable >= 2.0.0
sonar.gitlab.only_issue_from_commit_line Show issue for commit line only (default false) Variable >= 2.1.0
sonar.gitlab.build_init_state State that should be the first when build commit status update is called (default pending) Administration, Variable >= 2.0.0
sonar.gitlab.disable_global_comment Disable global comment, report only inline (default false) Administration, Variable >= 2.0.0
sonar.gitlab.failure_notification_mode Notification is in current build (exit-code) or in commit status (commit-status) (default commit-status) Administration, Variable >= 2.0.0
sonar.gitlab.global_template Template for global comment in commit Administration, Variable >= 2.0.0
sonar.gitlab.ping_user Ping the user who made an issue by @ mentioning. Only for default comment (default false) Administration, Variable >= 2.0.0
sonar.gitlab.unique_issue_per_inline Unique issue per inline comment (default false) Administration, Variable >= 2.0.0
sonar.gitlab.prefix_directory Add prefix when create link for GitLab Variable >= 2.1.0
sonar.gitlab.api_version GitLab API version (default v4 or v3) Administration, Variable >= 2.1.0
sonar.gitlab.all_issues All issues new and old (default false, only new) Administration, Variable >= 2.1.0
sonar.gitlab.json_mode Create a json report in root for GitLab EE (codeclimate.json or gl-sast-report.json) Project, Variable >= 3.0.0
sonar.gitlab.query_max_retry Max retry for wait finish analyse for publish mode Administration, Variable >= 3.0.0
sonar.gitlab.query_wait Max retry for wait finish analyse for publish mode Administration, Variable >= 3.0.0
sonar.gitlab.quality_gate_fail_mode Quality gate fail mode: error, warn or none (default error) Administration, Variable >= 3.0.0
sonar.gitlab.issue_filter Filter on issue, if MAJOR then show only MAJOR, CRITICAL and BLOCKER (default INFO) Administration, Variable >= 3.0.0
sonar.gitlab.load_rules Load rules for all issues (default false) Administration, Variable >= 3.0.0
sonar.gitlab.disable_proxy Disable proxy if system contains proxy config (default false) Administration, Variable >= 4.0.0
sonar.gitlab.merge_request_discussion Allows to post the comments as discussions (default false) Project, Variable >= 4.0.0
sonar.gitlab.ci_merge_request_iid The IID of the merge request if it’s pipelines for merge requests Project, Variable >= 4.0.0
  • Administration : Settings globals in SonarQube
  • Project : Settings of project in SonarQube
  • Variable : In an environment variable or in the pom.xml either from the command line with -D

Configuration

  • In SonarQube: Administration -> General Settings -> GitLab -> Reporting. Set GitLab Url and Token

If sonar.gitlab.failure_notification_mode is commit-status then role is Developer else Reporter.

  • In SonarQube: Project Administration -> General Settings -> GitLab -> Reporting. Set project identifier in GitLab

Templates

Custom global/inline comment : Change language, change image, change order, print all issues, etc

Use FreeMarker syntax http://freemarker.org/

Variables

Usage : ${name}

name type description
url String GitLab url
projectId String Project ID in GitLab or internal id or namespace + name or namespace + path or url http or ssh url or url or web
commitSHA String[] SHA of the commit comment. Get first commitSHA[0]
refName String Branch name or reference of the commit
maxGlobalIssues Integer Maximum number of anomalies to be displayed in the global comment
maxBlockerIssuesGate Integer Max blocker issue for build failed
maxCriticalIssuesGate Integer Max critical issue for build failed
maxMajorIssuesGate Integer Max major issue for build failed
maxMinorIssuesGate Integer Max minor issue for build failed
maxInfoIssuesGate Integer Max info issue for build failed
disableIssuesInline Boolean Disable issue reporting as inline comments
disableGlobalComment Boolean Disable global comment, report only inline
onlyIssueFromCommitFile Boolean Show issue for commit file only
commentNoIssue Boolean Add a comment even when there is no new issue
revision String Current revision
author String Commit's author for inline
lineNumber Integer Current line number for inline issues only
BLOCKER Severity Blocker
CRITICAL Severity Critical
MAJOR Severity Major
MINOR Severity Minor
INFO Severity Info
sonarUrl String Url of SonarQube
publishMode Boolean true if publish mode
qualityGate QualityGate QualityGate
OK Status Passed QualityGate & Condition sta

Issues· 0 open

View all issuesOpen on GitHub

No open issues yet, or sync has not completed.

> Tags

Javagitlabsonar-gitlab-pluginsonarqube

No comments yet. Be the first to share.

> Details

PublishedAug 1, 2026
UpdatedSep 17, 2026
Category开发工具
PricingOpen source

> Related tools

V
VS Code
流行的开源代码编辑器
G
Git
分布式版本控制系统
V
Vite
下一代前端构建工具