Run SonarQube Analysis

Before you analyse a project in SonarQube, you need to create a config file called sonar-project.properties in the root folder:

1
2
3
4
5
6
7
8
9
10
11
sonar.projectKey=secure-typescript-boilerplate
sonar.projectName=secure-typescript-boilerplate
sonar.projectVersion=1.0
sonar.language=ts
sonar.sources=src
sonar.sourceEncoding=UTF-8
sonar.exclusions=src/**/*.test.ts
sonar.test.inclusions=src/**/*.test.ts
sonar.coverage.exclusions=src/**/*.test.ts,src/**/*.mock.ts,node_modules/*,coverage/lcov-report/*
sonar.typescript.lcov.reportPaths=coverage/lcov.info
sonar.testExecutionReportPaths=coverage/test-reporter.xml

This file defines the project name, key, and version. It also specifies the programming language, code location, and the code coverage report.

To run the SonarQube analysis we will need an auxiliary module called sonarqube-scanner:

1
npm install --save-dev sonarqube-scanner

The module expects to find a file called sonar-project.js in the project root. Let’s create it:

1
2
3
4
5
6
7
8
9
10
11
12
const sonarqubeScanner = require('sonarqube-scanner');

sonarqubeScanner(
  {
    serverUrl: process.env.SONAR_SERVER || 'http://localhost:9000',
    token: process.env.SONAR_TOKEN || '',
    options: {}
  },
  () => {
    console.log('>> Sonar analysis is done!');
  }
);

Now we can run sonarqube-scanner with node sonar-project.js and this will submit our code sonar server. By default, the local server is used, but this can be overriden via environment variables. Go on and test it to make sure it works.

The sonarqube-scanner module has one shortcoming. It starts the SonarQube analysis asynchronously and it doesn’t wait for it to complete. This is problematic when you want to integrate the code scan into a CI/CD pipeline. You may need to wait for the analysis to complete and either fail/proceed based on the result.

Thus, we’ll use another module called sonarqube-verify:

1
npm install --save-dev sonarqube-verify

The sonarqube-verify library is a wrapper of sonarqube-scanner. It starts the code analsys and then checks its progress every few seconds. On completion, it either suceeds or fails based on the analysis result.

Let’s create the script to run it:

1
2
3
4
5
6
{
  ...
  "scripts": {
    "sonar": "sonarqube-verify"
  }
}

Now we can run the analysis:

1
2
3
4
5
6
7
8
# Generate the test coverage report
npm test

# Run the analysis (remember to start SonarQube)
npm run sonar

# Visit http://localhost:9000/projects to see result 
# login with admin/admin

Check out the documentation of sonarqube-verify to see how to push to a remote server via env variables.

1
npm install --save-dev husky

1
2
3
"hooks": {
  "pre-push": "npm build && npm test && npm run lint && npm run audit-dependencies"
}