Skip to content

Maven plugin for scanning source code with combination of dependency-check, checkstyle, spotbugs, pmd and generate reports for SonarQube

License

Notifications You must be signed in to change notification settings

BarrieShieh/sonar-oss-scanner-maven-plugin

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

25 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

This plugin will scan the code with source code with dependency-check, checkstyle, spotbugs, pmd and generate reports for SonarQube

Embedded scanner

This scanner is embedded with following scanner by default

Embedded Plugin name Embedded Plugin version Description
dependency-check-maven 6.1.0
maven-checkstyle-plugin 3.1.2 With Google Java Style
spotbugs-maven-plugin 4.2.0 With findsecbugs(LATEST), sb-contrib(LATEST)
maven-pmd-plugin 3.14.0

Example Usage

How to use this plugin in the project

# Build the project
mvn clean compile package
# Generate the reports
mvn oss:scan
# Do the sonar scan
mvn sonar:sonar

SonarQube properties

<properties>
    <sonar.dependencyCheck.jsonReportPath>${project.build.directory}/dependency-check-report.json</sonar.dependencyCheck.jsonReportPath>
    <sonar.dependencyCheck.htmlReportPath>${project.build.directory}/dependency-check-report.html</sonar.dependencyCheck.htmlReportPath>
    <sonar.dependencyCheck.xmlReportPath>${project.build.directory}/dependency-check-report.xml</sonar.dependencyCheck.xmlReportPath>
    <sonar.java.checkstyle.reportPaths>${project.build.directory}/checkstyle-result.xml</sonar.java.checkstyle.reportPaths>
    <sonar.java.spotbugs.reportPaths>${project.build.directory}/spotbugsXml.xml</sonar.java.spotbugs.reportPaths>
    <sonar.java.pmd.reportPaths>${project.build.directory}/pmd.xml</sonar.java.pmd.reportPaths>
</properties>

Maven Dependency

NOTE: This plugin is not in the central maven yet. You need to use mvn install to add it to local repository.

Add this to your pom.xml:

<plugin>
    <groupId>org.twdata.maven</groupId>
    <artifactId>sonar-oss-scanner-plugin</artifactId>
    <version>1.0.5</version>
</plugin>

Parameter configLocation is optional. You can specify the absolute path for the external plugin configurations.

<plugin>
    <groupId>org.twdata.maven</groupId>
    <artifactId>sonar-oss-scanner-plugin</artifactId>
    <version>1.0.5</version>
    <configuration>
        <configLocation>
          C:/plugins.xml
        </configLocation>
    </configuration>
</plugin>

You can add more analyzer to the plugins.xml with following format

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <plugins>
        <plugin>
            <goal>${goal}</goal>
            <plugin>
                <groupId>${groupId}</groupId>
                <artifactId>${artifactId}</artifactId>
                <version>${version}</version>
            </plugin>
            <configuration>
                ...
                ${pluginConfiguration}
            </configuration>
        </plugin>
    </plugins>
</configuration>

License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

Apache License, Version 2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Contributors

mojo-executor

sonarqube-licensecheck

checkstyle

spotbugs

pmd

mojo-api

About

Maven plugin for scanning source code with combination of dependency-check, checkstyle, spotbugs, pmd and generate reports for SonarQube

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published