Skip to main content

Connect with SonarQube

Last updated on
tip

Security Insights is in beta. To request access, contact Harness Support.

SonarQube is an open-source platform for continuous inspection of code quality. It performs automatic static analysis to detect bugs, code quality issues, and security vulnerabilities.

On initial setup, Harness SEI backfills up to 6 months of historical code quality findings. Once connected, the Open vulnerabilities by severity metric updates on the Security Insights dashboard in the Security tab of the Insights page.

Once connected, code quality findings from SonarQube contribute to organization-wide and team-level Security Insights metrics, including total open vulnerabilities.

Prerequisites​

Ensure that you have the SEI Admin role and an SonarQube API token.

Create a SonarQube API token​

To configure the SonarQube integration, you must create an API token in SonarQube. The token must be either a User Token or a Global Analysis Token, and have sufficient permissions to access organization and project-level analysis data. For SonarQube Cloud, the token is associated with a user and scoped by that user's organization access.

SonarQube tokens can also be scoped at the organization level. For more information about creating scoped organization tokens, see the official SonarQube documentation.

info

If your SonarQube instance uses an allowlist, ensure that required Harness IP addresses are permitted. For more information, see Harness Platform IPs.

Add the integration​

To add the integration:

  1. From the SEI navigation menu, click Account Management.

  2. On the Integrations page, select the Available Integrations tab.

  3. Locate the ArmorCode integration and click Add Integration.

  4. In the Overview section, provide a name for the integration (for example, SonarQube Production) and optionally, add tags.

  5. Click Continue.

  6. Add your SonarQube instance URL (for example, https://sonarcloud.io) in the SonarQube URL field.

  7. Enter your SonarQube API token in the API Token field. The token must be a User Token or Global Analysis Token.

  8. Click Continue.

  9. Optionally, limit ingestion to a specific organization or set of projects by entering a name in the Organization field and a project key in the Project Keys field.

    • Project keys are case-sensitive.
    • Leave the Project Keys field empty to ingest all projects.

  10. Click Continue to validate the connection.

  11. Once validation succeeds, click Finish.

Integration monitoring​

To monitor ingestion and aggregation activity, navigate to the Monitoring tab for the SonarQube integration. This tab displays ingestion logs, which show the status and execution details of each data sync.

You can click the Filters button to filter these logs by Status (for example: Success, Failed, Pending, or Scheduled). These statuses reflect the state of ingestion or aggregation jobs.

Ingestion Logs​

The following information is available for each ingestion and aggregation run.

ColumnDescription
Scan Range TimeThe time range for which data was fetched during ingestion.
Data Retrieval ProcessThe ingestion or aggregation method used to fetch and process data. If multiple aggregations occur, this reflects the most recent aggregation status.
Task Start TimeThe timestamp when the ingestion or aggregation job started.
StatusThe execution status of the job (for example, Success or Failed).
Time to CompleteTotal time taken for the job to finish execution.
RetriesNumber of times the job was retried before completion.
tip

Use ingestion logs to troubleshoot missing data, validate successful syncs, or identify delays in Security Insights reporting.

Next steps​

After configuring the SonarQube integration, you can:

  • Select the SonarQube integration from the Code Quality Tools section on the Integrations tab in Team Settings
  • View organization-wide security metrics in the Security Insights dashboard
  • Drill down into team-level vulnerabilities by selecting a team in the Org Tree