sonarqube-analysis-integration

name	SonarQube Analysis Integration
description	Access SonarQube 2025.1 Developer Edition via sonar-issues.sh CLI
keywords	sonarqube, sonar, code quality, issues, bugs, vulnerabilities, code smells, security hotspots, coverage

SonarQube CLI Integration (v2025.1)

Uses the sonar-issues.sh script for all SonarQube queries.

Project: YOUR-PROJECT-KEY (update with your SonarQube project key)

Commands

Project Overview

sonar-issues.sh summary

Shows: Total Issues, Counts by Severity/Type, Metrics

Critical Issues (BLOCKER + CRITICAL)

sonar-issues.sh critical

By Issue Type

# Bugs only
sonar-issues.sh bugs

# Vulnerabilities only
sonar-issues.sh vulns

# Code Smells only (optional: Severity)
sonar-issues.sh smells
sonar-issues.sh smells MAJOR

Security Hotspots

sonar-issues.sh hotspots

Issues in a Specific File

sonar-issues.sh file src/main/java/com/example/Service.java

Project Metrics

sonar-issues.sh metrics

Shows: bugs, vulnerabilities, code_smells, coverage, duplicated_lines_density, ncloc, ratings

All Issues (with Optional Severity Filter)

sonar-issues.sh all
sonar-issues.sh all MAJOR
sonar-issues.sh all BLOCKER,CRITICAL

List Projects

sonar-issues.sh projects

---

JSON Export for Analysis

# JSON output for Claude analysis
sonar-issues.sh json > sonar-issues.json
sonar-issues.sh json BLOCKER,CRITICAL,MAJOR > critical-issues.json

JSON Format:

[
  {
    "severity": "CRITICAL",
    "type": "BUG",
    "rule": "java:S2259",
    "file": "src/main/java/com/example/Service.java",
    "line": 42,
    "message": "A \"NullPointerException\" could be thrown...",
    "effort": "10min",
    "tags": ["cwe", "cert"]
  }
]

---

Raw API Queries

For custom queries:

sonar-issues.sh raw "severities=MAJOR&types=BUG&createdInLast=1w"

---

Typical Workflows

1. Quick Status Check

sonar-issues.sh summary

2. Fix Critical Issues Before Release

sonar-issues.sh critical

3. Code Smells in a Specific Package

sonar-issues.sh file src/main/java/com/example/service/

4. Export Issues for Claude Analysis

sonar-issues.sh json BLOCKER,CRITICAL > .claude/analysis/sonar-critical.json

5. Security-Review

sonar-issues.sh vulns
sonar-issues.sh hotspots

---

Severities & Types

Severities: BLOCKER, CRITICAL, MAJOR, MINOR, INFO

Types: BUG, VULNERABILITY, CODE_SMELL

Hotspot Status: TO_REVIEW, ACKNOWLEDGED, FIXED, SAFE

---

Troubleshooting

Empty Results:

• Is the project key correct? (not the name)
• Use sonar-issues.sh projects to verify

API Docs for Your Instance:

https://YOUR-SONARQUBE/web_api