Sonarqube on Software Factory

EcoCode plugin

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Welcome to the EcoCode tutorial, an initiative dedicated to fostering sustainability within software development at Thales.

The Software Factory contributes to this initiative by proposing Green Code Initiative’s plugins and adopting innovative and efficient coding practices.

In today’s digital era, software development plays a critical role in shaping our environmental footprint.

Note

Eco Coding is not just about writing efficient code. Learn more about ecodesign practices .

Sandboxing Issue Triage

Mon, 01 Jan 0001 00:00:00 +0000

This page explains the Issue Sandboxing behavior you will see after the upgrade. This page is designed to help you prepare for the upgrade.

SonarQube 2026.1 LTA — What new to expect

We are upgrading from SonarQube 2025.1 LTA → 2026.1 LTA.

TL;DR

A major LTA-to-LTA upgrade brings a significant number of new and improved rules across all languages.

New issues can appear on code you haven’t touched — either because the analyzers got smarter or because new rules were added to the quality profile.

Service Account

Mon, 01 Jan 0001 00:00:00 +0000

Service Account Creation

A “Service Account” refers to a dedicated account with specific privileges and permissions designed for integration with external services or systems during the CI/CD (Continuous Integration/Continuous Deployment) pipeline. This account is typically used to authenticate and interact with external services, such as cloud providers, container registries, or other tools essential for the pipeline workflow.

To create a Service account, refer to your platform availability .

SonarQube

To be able to push a SonarQube analysis on the server, you need to configure credentials.

SonarQube

Mon, 01 Jan 0001 00:00:00 +0000

SonarQube is a Static Code Analysis tool designed to help you catch and fix code issues early in the Software Development Life Cycle (SDLC), before they become major production problems.

Static code analysis (also known as code scanning or linting) is the automated process of examining source code without executing it.

This process helps in identifying potential issues and vulnerabilities in the codebase, such as unparsable syntax, unreachable and unused code, duplicate code, potentially vulnerable code, leaked secrets, and violations of coding standards and conventions.

SonarQube usage

Mon, 01 Jan 0001 00:00:00 +0000

This guide will assist you in getting started with SonarQube and performing various tasks efficiently using the tool.

Important

Some actions cannot be performed directly by users and should be performed by submitting a ticket.

What's new

Mon, 01 Jan 0001 00:00:00 +0000

SonarQube has released a new version with exciting features and improvements.

We will discuss some of the key highlights that are activated and available within the Software Factory.

Features to look for in SonarQube Server 2025.1 LTA

For this new major SonarQube Server version the following new features will be available:

Project Administration

Guided configuration of all projects in a monorepo
Flexible main branch designation
Guidance on project onboarding related to new code configuration .

Analyzers, Scanners

Faster analysis bootstrap
Faster scan times
Improved experience for C and C++ analysis
Maven scanner scans all files
New C, C++, and Objective-C GitHub Action

Quality Gates and Quality Profiles

Set rule priority to uphold your coding standards
Updated Sonar Way quality gate condition
Exclude rule from inherited quality profile
Dual operating modes with Standard Experience Mode that preserves familiar rule and issue qualities and severities for users or Multi Quality Rule (MQR) Mode to more accurately represent the impact an issue has on all software qualities

Issues on previous version as 9.9.x

Issue: Refers to a problem or defect detected in the source code that does not comply with a rule. It can potentially impact the quality and maintainability of the software. Here are the 5 common types of issues in SonarQube: