SonarQube最佳实践

version: '3'
services:
  # 使用 PostgreSQL 作为 SonarQube 的持久化方案
  # 注：由于 SonarQube 7.9 及之后的版本不支持 MySQL，因此 MySQL 不作为考虑对象
  postgres:
    image: postgres:12
    container_name: sonarqube_postgres
    privileged: true
    ports:
      - "5432:5432"
    networks:
      - sonarnet
    restart: always
    # 将 PostgreSQL 数据文件存放至宿主机
    volumes:
      - ./postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: sonar
      POSTGRES_USER: sonar
      POSTGRES_PASSWORD: sonar
  sonarqube:
    image: hub4rpi64/sonarqube:8.3.1.34397
    #image: hub4rpi64/sonarqube:7community
    container_name: sonarqube
    privileged: true
    ports:
      - "9000:9000"
    restart: always
    networks:
      - sonarnet
    depends_on:
      - postgres
    # 将 SonarQube 日志文件、数据文件、配置文件、扩展插件存放至宿主机
    volumes:
      - ./data:/opt/sonarqube/data
      - ./extensions:/opt/sonarqube/extensions
      - ./logs:/opt/sonarqube/logs
      - ./conf:/opt/sonarqube/conf
        #- ./lib:/opt/sonarqube/lib
    # 配置 SonarQube 的数据源，本例为 PostgreSQL
    environment:
      SONAR_JDBC_USERNAME: sonar
      SONAR_JDBC_PASSWORD: sonar
      SONAR_JDBC_URL: jdbc:postgresql://postgres:5432/sonar?useUnicode=true&characterEncoding=utf8
    # 由于 SonarQube 内部会启动 ElasticSearch，因此需要此配置
    ulimits:
      nproc: 65535
      nofile:
        soft: 65536
        hard: 65536
networks:
  sonarnet:
    driver: bridge

https://github.com/xuhuisheng/sonar-l10n-zh

# 最高4.1.0
https://github.com/gabrie-allaigre/sonar-gitlab-plugin
# 4.2.0
https://github.com/javamachr/sonar-gitlab-plugin/releases/tag/4.2.0

https://github.com/mc1arke/sonarqube-community-branch-plugin

docker cp sonarqube-community-branch-plugin.jar <容器id>:/opt/sonarqube/lib/common

volumes:
  - ./sonarqube-community-branch-plugin.jar:/opt/sonarqube/lib/common/sonarqube-community-branch-plugin.jar

<pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.sonarsource.scanner.maven</groupId>
          <artifactId>sonar-maven-plugin</artifactId>
          <version>3.7.0.1746</version>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>0.8.4</version>
        </plugin>
      </plugins>
</pluginManagement>
<plugins>
  <plugin>
    <groupId>org.jacoco</groupId>
    <artifactId>jacoco-maven-plugin</artifactId>
    <executions>
      <execution>
        <id>prepare-agent</id>
        <goals>
          <goal>prepare-agent</goal>
        </goals>
      </execution>
      <execution>
        <id>report</id>
        <goals>
          <goal>report</goal>
        </goals>
      </execution>
    </executions>
  </plugin>
</plugins>

stages:
  - sonarqube_analysis
  - dependecy-check
variables:
  APP_NAME: xxxx
  SONAR_TOKEN: xxxx
  SONAR_HOST_URL: http://ip:port
# 执行 SonarQube 分析，并将检测结果反馈至 GitLab
sonarqube_analysis:
  stage: sonarqube_analysis
  script:
    - mvn --batch-mode verify -Dmaven.test.skip=true sonar:sonar -Dsonar.projectKey=$APP_NAME -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.login=$SONAR_TOKEN -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME -Dsonar.branch.name=$CI_COMMIT_REF_NAME -Dsonar.gitlab.project_id=$CI_PROJECT_ID
  tags:
    - xxx

https://github.com/jeremylong/DependencyCheck/

stages:
  - dependecy-check
# 依赖扫描
dependecy-check:
  stage: dependecy-check
  script:
    - mvn clean package -Dmaven.test.skip=true
    - /opt/sonar/dependency-check/bin/dependency-check.sh -s xx.jar -f HTML -o ./java-sec-code-report.html
    - mvn --batch-mode verify sonar:sonar -Dsonar.projectKey=$APP_NAME -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.login=$SONAR_TOKEN -Dsonar.dependencyCheck.htmlReportPath=java-sec-code-report.html
  when: manual
  tags:
    - xxx