Introduction
Architecture
Introduction
IntroductionPromote an image in Amazon ECRDownload a file from JFrog ArtifactoryMove or copy an image from JFrog ArtifactoryUpload a file to JFrog ArtifactoryStore an object on Amazon S3Retrieve an object from Amazon S3
IntroductionCreate or update a functionInvoke a function
IntroductionRun an AWS CodePipelineRun a Bamboo projectRun a Bitbucket pipelineRun a CloudBees CI jobRun a CircleCI workflowRun a GitHub Actions workflowRun a GitLab pipelineRun a Harness pipelineRun a Jenkins® jobRun a JFrog pipelineRun a TeamCity project
Check out a Git repository
IntroductionAWS credentialsECR credentialsEKS credentialsGit global credentialsOCI credentials
IntroductionRun Argo WorkflowsDeploy a binary with EC2Deploy to ECSRender an ECS task definitionBuild a container image with KanikoDeploy with OctopusDeploy with Spinnaker
IntroductionHelm chart installHelm chart packageHelm chart publishHelm chart uninstall
IntroductionCreate a Kubernetes namespaceCreate/update a Kubernetes resourceDeploy to a Kubernetes cluster
IntroductionVerify with NewRelic
Execute remote commands via SSH
IntroductionAnchoreAquasecJFrog XraySnyk ContainerSonatype (Nexus) ContainerTrivy
IntroductionStackhawkZAP
IntroductionCheckmarxFind Security BugsGitHub Security ScannerGosecMendNexus IQSnykSonarQube bundledSonarQube
IntroductionMendSnyk
Components

CloudBees action: Scan with SonarQube bundled

1 minute read
If you already are running a centralized SonarQube, use the Scan with SonarQube action instead.

If you do not have a centralized SonarQube already installed, use this action to scan a Git repository with the SonarQube static application security testing (SAST) scanner, which detects security flaws and provides suggested code fixes. SonarQube scan results are displayed in CloudBees platform analytics dashboards, but not in SonarQube reports, as the SonarQube instance is headless/ephemeral.

For code coverage information, you have to use a third-party coverage tool, as SonarQube itself does not calculate coverage. Configure the SonarQube bundled action to import coverage results by either specifying a coverage file or running a unit test.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Inputs

Table 1. Input details
Input name Data type Required? Description

sonar-exclusion

String

No

SonarQube Exclusion pattern to exclude matching files.

sonar-inclusion

String

No

SonarQube Inclusion pattern to include matching files.

cover-file-name

String

No

The file path of the third-party code coverage tool results.

language

String

Yes

The language of your Git repository code base. Refer to Supported languages.

Supported languages

Table 2. Supported languages with inputs
Supported language Input format

Go

LANGUAGE_GO

Java

LANGUAGE_JAVA

JavaScript

LANGUAGE_JS

PHP

LANGUAGE_PHP

Python

LANGUAGE_PYTHON

Usage example

In your YAML file, add:

      - name: Scan with SonarQube bundled
        uses: cloudbees-io/sonarqube-bundled-sast-scan-code@v1
        with:
          sonar-exclusion: sonar/*
          cover-file-name: ./coverage.xml
          language: LANGUAGE_PYTHON
▼
Snyk
SonarQube