[STORY-SCAN] SonarQube PR Scanning Integration (Multibranch Pipeline)

[williammorrison2]

SonarQube PR Scanning Integration (Multibranch Pipeline)

Objective

Enable SonarQube Pull Request and Branch scanning using the Jenkins Shared Library (sonarqube-lib) and multibranch pipeline setup.

---

Required Steps

1. Create GitHub Label (if not exists)

Create the following label in the repository:

• Name: SonarQube
• Description: SonarQube
• Color: #D4C5F9

This label will be used for:

• Auto-created issues from SonarQube failures
• Manual tracking of SonarQube-related work

---

2. Setup GitHub Webhook

Configure webhook to trigger Jenkins:

• URL: https://tcd-jenkins.swg-devops.com/github-webhook/
• Content type: application/json

Events:

• Push
• Pull Requests

---

3. Add sonar-project.properties

# Format is $GHE_ORG_ID-$GHE_REPO_ID
sonar.projectKey=1459110-989134054

# Format is $GHE_ORG_NAME/$GHE_ORG_REPO
sonar.projectName=IBM/aiu-trace-analyzer

# Files / Folders to exclude. Note, this doesn't work unless entered in command-line
sonar.exclusions=""

# SonarQube Host URL
sonar.host.url=https://sonarqube-prod.apps.wdc-sonarqube-prod.core.cirrus.ibm.com

4. Add Jenkinsfile (Shared Library) Jenkinsfile.sonarqube

Note: This file will also be in the root directory of this repo (same location as the sonar-project.properties)

@Library('sonarqube-lib') _
multiBranchSonarQubeScan()

Expected Outcome

SonarQube scan runs on:

• Pull Requests
• Branch pushes

GitHub integration:

• Commit status updates
• PR comments (bugs, coverage, etc.)
• Issue creation on Quality Gate failure (tagged with SonarQube label)

Notes

• Quality Gate is non-blocking
• Pipeline should not fail due to SonarQube issues
• Ensure Jenkins Multibranch Pipeline is configured

Acceptance Criteria

• SonarQube label exists in repository
• Webhook configured and triggering Jenkins
• sonar-project.properties added and validated
• Jenkinsfile updated with shared library
• PR scan successfully runs
• Quality Gate result visible in PR
• GitHub issue auto-created on failure (with SonarQube label)

[lasch]

@williammorrison2 can this be closed?
Maybe check if any of the recent PRs (e.g. #93 or #94 ) did trigger the corresponding scans before calling it 'done'.

[lasch]

@williammorrison2 looks like the scanning wasn't triggered (at least not) for #93 because I'm seeing an issue flagged on main.
Anything that should be checked on your end?

[lasch]

@williammorrison2 is this functional and completed so issue can be closed?

[lasch]

@williammorrison2 This is not yet working correctly. The scan was not triggered for a recent PR and then an issue got flagged on main again.
Anything to do here on the repo side? Or is this ball in your yard?