oidatiftla/sonarscanner repository overview

⁠Tags

Updates are always only to the latest versions of the SonarScanner (dotnet and java). Updates are performed for all active releases of the dotnet SDKs as mentioned on Download .NET⁠, as of writing this README it is net8.0, net7.0 and net6.0. The updates are triggered automatically via pipelines every day to check for newer versions.

• 5-net8.0 -> 5.0-net8.0 -> 5.0.1-net8.0 -> 6-for-dotnet-net8.0 -> 6.2-for-dotnet-net8.0 -> 6.2.0-for-dotnet-net8.0 -> net8.0 -> latest
• 5-net7.0 -> 5.0-net7.0 -> 5.0.1-net7.0 -> 6-for-dotnet-net7.0 -> 6.2-for-dotnet-net7.0 -> 6.2.0-for-dotnet-net7.0 -> net7.0
• 5-net6.0 -> 5.0-net6.0 -> 5.0.1-net6.0 -> 6-for-dotnet-net6.0 -> 6.2-for-dotnet-net6.0 -> 6.2.0-for-dotnet-net6.0 -> net6.0
• 5-net5.0 -> 5.0-net5.0 -> 5.0.1-net5.0 -> 6-for-dotnet-net5.0 -> 6.2-for-dotnet-net5.0 -> 6.2.0-for-dotnet-net5.0 -> net5.0 (deprecated)
• 5-net3.1 -> 5.0-net3.1 -> 5.0.1-net3.1 -> 6-for-dotnet-net3.1 -> 6.2-for-dotnet-net3.1 -> 6.2.0-for-dotnet-net3.1 -> net3.1 (deprecated)
• 5.0.3-net4.6 -> net4.6 (deprecated)

The suffixes -netX.X denote the base image (mcr.microsoft.com/dotnet/sdk:X.X).

The prefixes X.X.X- denote the SonarScanner⁠ version. When X.X.X-for-dotnet- is prefixed, then the SonarScanner for .NET⁠ is installed in that version (dotnet tool install --global dotnet-sonarscanner).

⁠Prerequisites

You need a SonarQube⁠ running. The simplest way to do this (only for testing purposes, for production environment see SonarQube⁠):

docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:latest

⁠Run with *-net8.0, *-net7.0, *-net6.0, *-net5.0 or *-net3.1

If you are interested on how the containers are build: https://github.com/OidaTiftla/sonar-scanner-cli-docker/blob/master/DEVELOPER.md⁠

Run it using:

docker run -d -v /path/to/project/:/mnt/code --name sonarscanner oidatiftla/sonarscanner:net8.0 /bin/bash -c 'while true; do sleep 1000; done'

Create a network to connect both containers (sonarqube and sonarscanner) and add those containers to the network:

docker network create sonar
docker network connect sonar sonarqube
docker network connect sonar sonarscanner

Get into the container with:

docker exec -it sonarscanner /bin/bash

For more details see: https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/⁠

⁠Run with *-net4.6 (deprecated)

This will only work on windows with Docker for Windows. You need to switch to Windows Containers by right-clicking on the docker tray-icon in the taskbar and then click Switch to windows containers .... Also you need to active the experimental features, so you can run the linux container (sonarqube) and the windows container (sonarscanner) in parallel.

After switching the Docker Engine to Windows Containers you may need to rerun/recreate the Prerequisites. But this time I had to increase the default memory with --memory 6g.

Then run it using (I had to increase the default memory with --memory 5g for bigger projects):

docker run -d -v C:\path\to\project\:C:\Code --name sonarscanner oidatiftla/sonarscanner:net4.6 powershell.exe -command {while ($true) { Start-Sleep 10 }}

In this case Windows automatically connects both containers in a network, so they can communicate with each other. You can test it with docker exec -it sonarscanner ping sonarqube.

Get into the container with:

docker exec -it sonarscanner powershell.exe

The binaries of the scanner are located at: C:\sonar-scanner-msbuild-*.*.*.*****-net4.6

You may want to update the config-file at: C:\sonar-scanner-msbuild-*.*.*.*****-net4.6\SonarQube.Analysis.xml

To run the analysis edit the file C:\sonarqube-analyze.cmd to point to the project path, where the *.sln file is located. And also adjust it to your project-key.

⁠Increase heap size for java vm for bigger projects

$myopts = [System.Environment]::GetEnvironmentVariable('SONAR_SCANNER_OPTS',[System.EnvironmentVariableTarget]::Machine)
$myopts += " -Xms256m -Xmx1024m"
[System.Environment]::SetEnvironmentVariable('SONAR_SCANNER_OPTS', $myopts, [System.EnvironmentVariableTarget]::Machine)

⁠Install node.js for further analysis of ASP.NET projects for example

If you have the following warnings:

• CSS rules were not executed. Error when running: 'node -v'. Is Node.js available during analysis?
• JavaScript and/or TypeScript rules were not executed. Error when running: 'node -v'. Is Node.js available during analysis?

You can install node.js:

choco install nodejs.install -y