关于SonarQube Web API创建项目及自动化分析的技术咨询

Absolutely! The SonarQube Web API can handle every part of your desired workflow—from creating projects programmatically to triggering analysis and fetching all the insights you need. You can absolutely build a fully automated pipeline for your web app with it. Let me walk you through the key steps with practical examples:

First, you’ll need a SonarQube token with permissions to create projects (either an admin token or one with the "Create Projects" global permission). Use the api/projects/create endpoint:

curl -X POST "http://your-sonarqube-instance/api/projects/create" \
  -H "Authorization: Bearer YOUR_SONAR_TOKEN" \
  -d "project=your-project-key&name=Your Project Name&visibility=public"

If you want to avoid duplicates, check if a project already exists first with the api/projects/search endpoint:

curl -X GET "http://your-sonarqube-instance/api/projects/search?projects=your-project-key" \
  -H "Authorization: Bearer YOUR_SONAR_TOKEN"

The Web API doesn’t run the code scanner directly, but you can integrate it into your automation flow to kick off the scanner after project creation. Here’s how it fits:

• After creating the project via API, run the sonar-scanner command with your project’s configuration (you can dynamically pull settings via the API if needed):

sonar-scanner \
  -Dsonar.projectKey=your-project-key \
  -Dsonar.sources=. \
  -Dsonar.host.url=http://your-sonarqube-instance \
  -Dsonar.login=YOUR_SONAR_TOKEN

• The scanner sends analysis data to SonarQube, which processes it asynchronously.

Once analysis finishes, use the API to pull all the data your web app needs:

• Check Quality Gate Status: Use api/qualitygates/project_status to see if the project passed or failed:

curl -X GET "http://your-sonarqube-instance/api/qualitygates/project_status?projectKey=your-project-key" \
  -H "Authorization: Bearer YOUR_SONAR_TOKEN"

• Retrieve Issues (Bugs, Vulnerabilities): Filter and fetch issues with api/issues/search:

curl -X GET "http://your-sonarqube-instance/api/issues/search?componentKeys=your-project-key&types=BUG,VULNERABILITY" \
  -H "Authorization: Bearer YOUR_SONAR_TOKEN"

• Get Metrics (Coverage, Duplication): Pull specific metrics with api/measures/component:

curl -X GET "http://your-sonarqube-instance/api/measures/component?component=your-project-key&metricKeys=coverage,duplicated_lines_density,ncloc" \
  -H "Authorization: Bearer YOUR_SONAR_TOKEN"

Tie all these steps together in your web app with a script (Python, Node.js, or shell) that:

1. Checks if the project exists in SonarQube.
2. Creates it if it doesn’t.
3. Triggers the sonar-scanner (directly or via your CI/CD pipeline).
4. Polls the api/ce/task endpoint to wait for analysis to complete (since it’s asynchronous):

   curl -X GET "http://your-sonarqube-instance/api/ce/task?id=ANALYSIS_TASK_ID" \
     -H "Authorization: Bearer YOUR_SONAR_TOKEN"
   

   (Grab the task ID from the scanner’s output or via api/ce/component.)
5. Fetches metrics/issues and displays them in your web app.

Quick Tips #

• Ensure your SonarQube token has the right permissions: Execute Analysis for running scans, Browse for fetching results.
• Your SonarQube instance has built-in API docs at http://your-sonarqube-instance/web_api to cross-check endpoint details for your version.

内容的提问来源于stack exchange，提问作者Cuauhtémoc Pascacio