SonarQube Server is a code quality and security platform that software teams host on their own servers to analyze source code and find bugs, vulnerabilities, and code smells.
Hevo uses the SonarQube Web API to replicate the projects, analyses, branches, issues, rules, metrics and measures, users, and groups of your SonarQube Server instance to the Destination of your choice. To ingest data, you must provide Hevo with the host name of your SonarQube Server instance and a user token of a SonarQube administrator.
Supported Features
| Feature Name | Supported |
|---|---|
| Capture deletes | Yes |
| History mode | No |
| Custom data (user-configured tables & fields) | No |
| Data blocking (skip objects and fields) | Yes |
| Resync (objects and Pipelines) | Yes |
| API configurable | Yes |
Prerequisites
-
A SonarQube Server instance from which data is to be ingested. SonarQube Cloud is not supported.
-
Your SonarQube Server instance is reachable from Hevo over HTTPS, through a host name such as sonarqube.example.com.
-
A SonarQube user with the Administer System permission is available to create the token. Read Create a User Token.
Create a User Token
Hevo connects to your SonarQube Server instance using a user token. The token acts as the SonarQube user who creates it, with the same permissions. SonarQube displays the token only once.
Perform the following steps to create a user token:
-
Log in to your SonarQube Server instance as a user with the Administer System permission.
-
In the top-right corner, click your user avatar, and then click My account.
-
In the left navigation pane, click Security.
-
Under Generate Tokens, do the following:
-
In the Name field, specify a name for the token. For example, Hevo.
-
In the Type drop-down, select User Token.
-
In the Expires in drop-down, select when the token must expire. Default value: 30 days. Once the token expires, Hevo cannot ingest data until you create a new token and update it in your Source configuration.
-
Click Generate.
-
-
Click the copy icon next to the token to copy it, and save it securely like any other password.
Configure SonarQube as a Source in your Pipeline
Perform the following steps to configure your SonarQube Source:
-
Click Pipelines in the Navigation Bar.
-
Click + Create Pipeline in the Pipelines List View.
-
On the Select Source Type page, select SonarQube.
-
On the Select Destination Type page, select the type of Destination you want to use.
-
In the Configure Source screen, specify the following:
-
Source Name: A unique name for your Source, not exceeding 255 characters. For example, SonarQube Source.
-
In the Connect to SonarQube Server section, specify the following:
-
User Token: The user token that you created in SonarQube.
-
Host: The host name of your SonarQube Server instance, without https:// or a path. For example, sonarqube.example.com.
-
Component Types: The types of SonarQube components whose measures Hevo must ingest. Select one of the following:
-
Projects only (all editions): Measures of projects. Default selection. Use this option with SonarQube Community Build.
-
Projects and applications (Developer Edition and higher): Measures of projects and applications.
-
Projects, applications and portfolios (Enterprise Edition and higher): Measures of projects, applications, and portfolios.
If you select a component type that your SonarQube edition does not support, the ingestion of measures fails.
-
-
-
-
Click Test & Continue to test the connection to your SonarQube Source. Once the test is successful, you can proceed to set up your Destination.
Data Replication
Hevo replicates data for all the objects selected on the Configure Objects page during Pipeline creation. By default, all supported objects and their available fields are selected. However, you can modify this selection while creating or editing the Pipeline. To ingest a child object, you must also select its parent object. For example, to ingest the Issue Comment object, you must also select the Issue object. The Data Model lists the child objects of each parent object.
In each run of the Pipeline, as per the sync frequency, Hevo ingests:
-
Issue and its child objects: The issues created after the last run. The first run ingests all the issues. Changes to existing issues are not ingested. Read Source Considerations.
-
All other objects: The entire data of the object.
You can resync all the objects except the child objects. Resyncing a parent object also resyncs its child objects.
Note: You can create a Pipeline with this Source only using the Merge load mode. The Append mode is not supported for this Source.
Schema and Primary Keys
Hevo uses the following schema to upload the records in the Destination. For a detailed view of the objects, fields, and relationships, click the ERD.
Data Model
The following is the list of tables (objects) that are created at the Destination when you run the Pipeline:
| Object | Description |
|---|---|
| Component | Contains the details of each project as a component, including the name, version, visibility, and the dates of the last analysis and the start of the new code period. It includes a child object, Component Tag. |
| Component Tag | Contains the tags assigned to each project. |
| Groups | Contains the user groups of your SonarQube instance, including the name, description, number of members, and whether the group is the default group. |
| Issue | Contains the issues that SonarQube finds in the code of each project, including the rule, component, location, message, severity, type, status, resolution, effort, author, and the creation and update dates. It includes the child objects, Issue Comment, Issue Flow Location, and Issue Tag. |
| Issue Comment | Contains the comments on each issue, including the author’s login, the text in HTML and Markdown, and the creation date. |
| Issue Flow Location | Contains the code locations that make up the flow of each issue, such as the steps that lead to a vulnerability, including the component, lines, and message. |
| Issue Tag | Contains the tags assigned to each issue. |
| Measures Component | Contains the value of each metric for each component, such as a project, including the value for the new code period. |
| Measures Component Tree | Contains the value of each metric for the files and directories of each component, including the path and the value for the new code period. |
| Metric | Contains the metrics that SonarQube calculates, such as lines of code, coverage, and number of bugs, including the key, name, domain, type, and whether a higher value is better. It includes the child objects, Measures Component, Measures Component Tree, and Metric Component. |
| Metric Component | Contains the components of the selected types for which each metric is ingested. |
| Project | Contains the projects of your SonarQube instance, including the key, name, visibility, revision, and the date of the last analysis. It includes the child objects, Component, Project Analyse, Project Branch, Project Link, and Project Pull Request. |
| Project Analyse | Contains the analyses of each project, including the date, project version, revision, and build string. It includes a child object, Project Analyse Event. |
| Project Analyse Event | Contains the events of each analysis, such as a change in the quality gate status or a new version, including the category, name, and description. |
| Project Branch | Contains the branches of each project, including the name, type, quality gate status, whether it is the main branch, and the date of the last analysis. |
| Project Link | Contains the links added to each project, such as the home page or the issue tracker, including the name, type, and URL. |
| Project Pull Request | Contains the pull requests analyzed for each project, including the title, branch, target branch, quality gate status, and the number of bugs, vulnerabilities, and code smells. Pull request analysis requires SonarQube Developer Edition or higher. |
| Rule | Contains the coding rules available in your SonarQube instance, including the name, language, repository, severity, type, status, and description. It includes the child objects, Rule Param, Rule Sys Tag, and Rule Tag. |
| Rule Param | Contains the parameters of each rule, including the default value, type, and description. |
| Rule Sys Tag | Contains the system tags that SonarQube assigns to each rule. |
| Rule Tag | Contains the tags that your users assign to each rule. |
| User Group | Contains the groups that each user belongs to. |
| User SCM Account | Contains the source control management (SCM) accounts of each user, which SonarQube uses to assign issues to the user. |
| Users | Contains the users of your SonarQube instance, including the login, name, email address, whether the user is active, the identity provider, and the dates of the last connection. It includes the child objects, User Group and User SCM Account. |
Additional Information
Read the detailed Hevo documentation for the following related topics:
Handling of Deletes
Hevo captures deletes for all the objects except Issue and its child objects. In each run, Hevo compares the data ingested from the Source with the data present in the Destination. If a record exists in the Destination but is no longer returned by the Source, Hevo marks it as deleted by setting the value of the metadata column __hevo__marked_deleted to True. The record remains in the Destination with all its data. For example, when you delete a project in SonarQube, Hevo marks the project and its child records, such as its branches and analyses, as deleted.
Hevo does not capture deletes for the Issue object and its child objects. The issues of a deleted project remain in the Destination.
Source Considerations
-
Hevo ingests only the issues created after the last run. Changes to an existing issue, such as a new status, resolution, or tag, are not ingested in later runs. To update the existing issues in the Destination, resync the Issue object.
-
Hevo ingests the measures of each metric for each component separately. As a result, the number of API requests in each run increases with the number of metrics and components in your SonarQube instance, and a run may take longer to complete.
-
SonarQube analyzes pull requests only in the Developer Edition and higher. In SonarQube Community Build, the Project Pull Request object does not contain any data.
-
Hevo ingests only the active users of your SonarQube instance. When you deactivate a user, Hevo marks the user as deleted.
-
Your user token expires on the date that you select when you create it. Before it expires, create a new token and update it in your Source configuration.
Limitations
-
Hevo does not support SonarQube Cloud.
-
Hevo does not ingest the assignee of an issue, security hotspots, quality gates, quality profiles, or the source code of your projects.