sonarqube

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

SonarQube / SonarCloud

When NOT to Use This Skill

何时不应使用本技能

JavaScript/TypeScript linting - Use
```
eslint-biome
```
skill for faster feedback
Security scanning - Use
```
owasp-top-10
```
or security-scanner MCP
Test execution - Use Vitest/Playwright skills for running tests
Code coverage generation - Use JaCoCo/Vitest skills for coverage

Deep Knowledge: Use
mcp__documentation__fetch_docs
with technology:
sonarqube
for comprehensive documentation.

JavaScript/TypeScript 代码检查 - 使用
```
eslint-biome
```
技能获取更快的反馈
安全扫描 - 使用
```
owasp-top-10
```
或安全扫描MCP
测试执行 - 使用Vitest/Playwright技能运行测试
代码覆盖率生成 - 使用JaCoCo/Vitest技能生成覆盖率

深度知识: 调用
mcp__documentation__fetch_docs
并指定technology参数为
sonarqube
，可获取完整官方文档。

Official Documentation

官方文档

Resource	Link
SonarQube Docs	https://docs.sonarsource.com/sonarqube/latest/
SonarCloud Docs	https://docs.sonarsource.com/sonarcloud/
Rules Repository	https://rules.sonarsource.com/
API Reference	https://sonarcloud.io/web_api/

资源	链接
SonarQube 文档	https://docs.sonarsource.com/sonarqube/latest/
SonarCloud 文档	https://docs.sonarsource.com/sonarcloud/
规则仓库	https://rules.sonarsource.com/
API 参考	https://sonarcloud.io/web_api/

Quick Setup

快速安装

SonarCloud (Recommended for Open Source)

SonarCloud（开源项目推荐使用）

bash

undefined

bash

undefined

1. Connect repo at sonarcloud.io

1. 在sonarcloud.io关联代码仓库

2. Create sonar-project.properties

2. 创建sonar-project.properties配置文件


```properties


```properties

sonar-project.properties

sonar.projectKey=org_project sonar.organization=your-org sonar.sources=src sonar.tests=tests sonar.javascript.lcov.reportPaths=coverage/lcov.info sonar.coverage.exclusions=/*.test.ts,/*.spec.ts

undefined

sonar.projectKey=org_project sonar.organization=your-org sonar.sources=src sonar.tests=tests sonar.javascript.lcov.reportPaths=coverage/lcov.info sonar.coverage.exclusions=/*.test.ts,/*.spec.ts

undefined

SonarQube (Self-hosted)

SonarQube（自托管版本）

yaml

undefined

yaml

undefined

docker-compose.yml

services: sonarqube: image: sonarqube:lts-community ports: - "9000:9000" environment: - SONAR_JDBC_URL=jdbc:postgresql://db:5432/sonar volumes: - sonarqube_data:/opt/sonarqube/data

---

services: sonarqube: image: sonarqube:lts-community ports: - "9000:9000" environment: - SONAR_JDBC_URL=jdbc:postgresql://db:5432/sonar volumes: - sonarqube_data:/opt/sonarqube/data

---

Quality Gates

质量门禁（Quality Gates）

Default Quality Gate Conditions

默认质量门禁规则

Metric	Condition	Target
Coverage	on new code	≥ 80%
Duplicated Lines	on new code	≤ 3%
Maintainability Rating	on new code	A
Reliability Rating	on new code	A
Security Rating	on new code	A
Security Hotspots Reviewed	on new code	100%

指标	生效范围	要求阈值
覆盖率	新增代码	≥ 80%
重复行占比	新增代码	≤ 3%
可维护性评级	新增代码	A
可靠性评级	新增代码	A
安全评级	新增代码	A
已审查安全热点	新增代码	100%

Custom Quality Gate

自定义质量门禁

bash

undefined

bash

undefined

Create via API

通过API创建

curl -X POST "https://sonarcloud.io/api/qualitygates/create"
-H "Authorization: Bearer $SONAR_TOKEN"
-d "name=Strict"

---

curl -X POST "https://sonarcloud.io/api/qualitygates/create"
-H "Authorization: Bearer $SONAR_TOKEN"
-d "name=Strict"

---

CI/CD Integration

CI/CD 集成

GitHub Actions

yaml

undefined

yaml

undefined

.github/workflows/sonar.yml

name: SonarCloud on: [push, pull_request]

jobs: sonarcloud: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0

  - name: SonarCloud Scan
    uses: SonarSource/sonarcloud-github-action@master
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

undefined

name: SonarCloud on: [push, pull_request]

jobs: sonarcloud: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0

  - name: SonarCloud 扫描
    uses: SonarSource/sonarcloud-github-action@master
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

undefined

Maven (Java)

xml

<!-- pom.xml -->
<plugin>
    <groupId>org.sonarsource.scanner.maven</groupId>
    <artifactId>sonar-maven-plugin</artifactId>
    <version>3.10.0.2594</version>
</plugin>

bash

mvn sonar:sonar \
  -Dsonar.projectKey=project \
  -Dsonar.host.url=https://sonarcloud.io \
  -Dsonar.token=$SONAR_TOKEN

xml

<!-- pom.xml -->
<plugin>
    <groupId>org.sonarsource.scanner.maven</groupId>
    <artifactId>sonar-maven-plugin</artifactId>
    <version>3.10.0.2594</version>
</plugin>

bash

mvn sonar:sonar \
  -Dsonar.projectKey=project \
  -Dsonar.host.url=https://sonarcloud.io \
  -Dsonar.token=$SONAR_TOKEN

Key Metrics

核心指标

Metric	Description	Good Value
Bugs	Reliability issues	0
Vulnerabilities	Security issues	0
Code Smells	Maintainability issues	Minimize
Coverage	Test coverage %	> 80%
Duplications	Duplicated code %	< 3%
Cognitive Complexity	Code understandability	< 15/function

指标	说明	理想值
Bug	可靠性问题	0
漏洞（Vulnerabilities）	安全问题	0
代码异味（Code Smells）	可维护性问题	尽量少
覆盖率	测试覆盖率百分比	> 80%
重复率	重复代码占比	< 3%
认知复杂度	代码可理解性	单函数<15

Language-Specific Rules

各语言专属规则

Language	Rules	Link
JavaScript/TS	422	https://rules.sonarsource.com/javascript/
Java	733	https://rules.sonarsource.com/java/
Python	300+	https://rules.sonarsource.com/python/
C#	400+	https://rules.sonarsource.com/csharp/
Go	100+	https://rules.sonarsource.com/go/

语言	规则数量	链接
JavaScript/TS	422	https://rules.sonarsource.com/javascript/
Java	733	https://rules.sonarsource.com/java/
Python	300+	https://rules.sonarsource.com/python/
C#	400+	https://rules.sonarsource.com/csharp/
Go	100+	https://rules.sonarsource.com/go/

Excluding Files

文件排除配置

properties

undefined

properties

undefined

sonar-project.properties

sonar.exclusions=/node_modules/,/dist/,/*.test.ts sonar.coverage.exclusions=/tests/,/mocks/** sonar.cpd.exclusions=/generated/

---

sonar.exclusions=/node_modules/,/dist/,/*.test.ts sonar.coverage.exclusions=/tests/,/mocks/** sonar.cpd.exclusions=/generated/

---

API Examples

API 示例

bash

undefined

bash

undefined

Get project status

获取项目状态

curl "https://sonarcloud.io/api/qualitygates/project_status?projectKey=KEY"
-H "Authorization: Bearer $SONAR_TOKEN"

Get issues

获取问题列表

curl "https://sonarcloud.io/api/issues/search?componentKeys=KEY&types=BUG"
-H "Authorization: Bearer $SONAR_TOKEN"

Get metrics

获取指标数据

curl "https://sonarcloud.io/api/measures/component?component=KEY&metricKeys=coverage,bugs,vulnerabilities"
-H "Authorization: Bearer $SONAR_TOKEN"

---

curl "https://sonarcloud.io/api/measures/component?component=KEY&metricKeys=coverage,bugs,vulnerabilities"
-H "Authorization: Bearer $SONAR_TOKEN"

---

Anti-Patterns

反模式

Anti-Pattern	Why It's Bad	Correct Approach
No quality gate on PRs	Merging bad code	Enable PR decoration, block on failure
Excluding all tests from coverage	Inflated coverage numbers	Only exclude test utilities
Ignoring code smells	Technical debt accumulates	Fix or justify with comments
No coverage reporting	Can't track quality trends	Configure coverage reports in CI
Using default quality gate	Too lenient for most projects	Create custom stricter gate
Not reviewing Security Hotspots	Potential vulnerabilities missed	Review all hotspots before release

反模式	弊端	正确做法
PR没有配置质量门禁检查	会合入低质量代码	开启PR装饰，质量门禁不通过则阻断合并
将所有测试文件排除在覆盖率统计外	会导致覆盖率数据虚高	仅排除测试工具类代码
忽略代码异味	技术债务不断累积	修复问题或添加注释说明合理原因
没有上报覆盖率数据	无法追踪质量变化趋势	在CI中配置覆盖率报告上报
使用默认质量门禁	对大多数项目来说规则过松	创建更严格的自定义质量门禁
不审查安全热点	会遗漏潜在安全漏洞	发布前审查所有安全热点

Quick Troubleshooting

快速排障

Issue	Likely Cause	Solution
Quality gate failed unexpectedly	New code coverage < 80%	Add tests or adjust coverage target
Analysis not running	Missing SONAR_TOKEN	Add token to CI secrets
Coverage always 0%	Wrong report path	Check `sonar.javascript.lcov.reportPaths`
Duplicated code false positives	Boilerplate code	Add to `sonar.cpd.exclusions`
Too many issues reported	First scan on legacy code	Use "New Code" focus, fix incrementally
PR decoration not working	Missing GitHub App integration	Configure SonarCloud GitHub App

问题	可能原因	解决方案
质量门禁意外不通过	新增代码覆盖率<80%	补充测试或调整覆盖率阈值
分析任务未运行	缺少SONAR_TOKEN	将token添加到CI的密钥配置中
覆盖率始终为0%	报告路径配置错误	检查 `sonar.javascript.lcov.reportPaths` 配置
重复代码误报	样板代码被识别为重复	添加到 `sonar.cpd.exclusions` 排除列表
上报问题数量过多	首次扫描老旧代码	聚焦「新增代码」维度，逐步修复存量问题
PR装饰不生效	缺少GitHub App集成	配置SonarCloud GitHub App

sonarqube

Original

Translation

SonarQube / SonarCloud

SonarQube / SonarCloud

When NOT to Use This Skill

何时不应使用本技能

Official Documentation

官方文档

Quick Setup

快速安装

SonarCloud (Recommended for Open Source)

SonarCloud（开源项目推荐使用）

1. Connect repo at sonarcloud.io

1. 在sonarcloud.io关联代码仓库

2. Create sonar-project.properties

2. 创建sonar-project.properties配置文件

sonar-project.properties

sonar-project.properties

SonarQube (Self-hosted)

SonarQube（自托管版本）

docker-compose.yml

docker-compose.yml

Quality Gates

质量门禁（Quality Gates）

Default Quality Gate Conditions

默认质量门禁规则

Custom Quality Gate

自定义质量门禁

Create via API

通过API创建

CI/CD Integration

CI/CD 集成

GitHub Actions

GitHub Actions

.github/workflows/sonar.yml

.github/workflows/sonar.yml

Maven (Java)

Maven (Java)

Key Metrics

核心指标

Language-Specific Rules

各语言专属规则

Excluding Files

文件排除配置

sonar-project.properties

sonar-project.properties

API Examples

API 示例

Get project status

获取项目状态

Get issues

获取问题列表

Get metrics

获取指标数据

Anti-Patterns

反模式

Quick Troubleshooting

快速排障

Related Skills

相关技能