---
name: ContinuousDelivery-sonarqube_integration
title: Configuring Sonarqube
description: SonarQube provides an overview of the overall health and quality of your source code and highlights issues that are found in new code. The code analyzers detect tricky bugs, such as null-pointer dereferences, logic errors, and resource leaks, for more than 20 coding languages.
last-updated: 2026-07-23
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/ContinuousDelivery?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Configuring Sonarqube
{: #sonarqube}

DevOps Insights will reach end of service and be discontinued on **August 31, 2026**. Continuous Delivery will be discontinued in the following regions on 12 February 2027: **au-syd**, **ca-mon**, **ca-tor**, **us-east**. Code Risk Analyzer will also be discontinued in all regions on that date. If a region has no active usage of these features, the features in that region may be discontinued earlier and stop accepting new instances. [Learn more](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-faq_region_feature_consolidation&format=markdown)
{: important}

SonarQube provides an overview of the overall health and quality of your source code and highlights issues that are found in new code. The code analyzers detect tricky bugs, such as null-pointer dereferences, logic errors, and resource leaks, for more than 20 coding languages.
{: shortdesc}

Configure SonarQube to continuously analyze and measure the quality of your source code:

1. From the IBM Cloud console, click the **Menu** icon ![hamburger icon](images/icon_hamburger.svg) > **Platform Automation** > **Toolchains**. On the Toolchains page, click the toolchain to open its Overview page.  
 
   a. Click **Add a Tool**.

   b. In the Tool Integrations section, click **SonarQube**.

1. Type a name for this instance of the SonarQube tool integration.
1. Type the URL for the SonarQube instance that you want to open when you click the SonarQube card from your toolchain.
1. Optional: Type the user name that you use to connect to the SonarQube server.

   You need to specify a user name only if you use a password to connect to the SonarQube server. If you use an authentication token to connect, leave this field empty.
   {: tip}

1. Type the password or authentication token that you use to connect to the SonarQube server.
1. If the server cannot be located on the public internet, select **Advanced**. IBM Cloud cannot validate the connection details that you provide and certain functions that require API access to this server are disabled. The delivery pipeline works only by using a private worker that has network access to this server.
1. Click **Create Integration**.
1. On your Toolchain's Overview page, on the **Third-Party tools** card, click **SonarQube** to view the dashboard for the SonarQube instance that you connected to.

## Adding Sonarqube to the continuous integration pipeline
{: #sonarqube-ci-pipeline}

### Default SonarQube instance
{: #sonarqube-ci-pipeline-default}

If you don't have your own SonarQube instance, the pipeline creates a SonarQube instance during the pipeline run. You can access this instance after the static-scan stage successfully runs.

### Existing SonarQube instance
{: #sonarqube-ci-pipeline-existing}

To add your own SonarQube instance to your existing pipeline, [add the tool integration](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-sonarqube&format=markdown) to your toolchain, and then add the Sonarqube tool integration parameter to the pipeline.

### Required parameters
{: #sonarqube-cipipeline-parm}

To run the SonarQube scan, the pipeline needs the following continuous integration parameters:

|Name |Type	|Description |Required or Optional |
|:----------|:------------------------------|:------------------|:----------|
|cluster-name 		|text 		|The name of the Docker build cluster.			|Required			|
|dev-region		|text		|The IBM Cloud region that hosts the cluster.			|Required			|
|opt-in-sonar		|text 		|The option to enable the sonarQube scan.		|Required			|
|sonarqube		|tool integration		|The Sonarqube tool integration.	|Optional			|
{: caption="Continuous integration pipeline parameters}

For more information about pipelines parameters, see [Pipeline parameters](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parm&format=markdown).

If you add multiple SonarQube tool integrations to your pipeline, you can switch between them by changing the value of the sonarqube pipeline parameter, which is a tool integration parameter.
{: tip}

### Updating the quality gate
{: #sonarqube-cipipeline-gate}

If you use the SonarQube instance that the pipeline created, you can update the default quality gate.

1. Go to the SonarQube dashboard that was created by the URL from the pipeline logs in the `static-scan` task. 

   ![SonarQube dashboard](images/sonar-quality-gate.png){: caption="SonarQube dashboars" caption-side="bottom"}

1. Click **Quality Gates** > **Create**. 
1. Set your Quality Gate by using one of the following options:

   * Click  **Set as Default** to set the newly created quality gate as the default.
   * From the dashboard, select the project and then click **Project Settings** > **Quality Gate** to use the newly created quality gate for the project.

1. Specify which quality gate you want to associate with the project. New scans are evaluated by this quality gate and evidence is created by the quality gate's results.

To learn more about SonarQube, see [SonarQube Documentation](https://docs.sonarsource.com/sonarqube/latest/){: external}.

### Using your own configuration file
{: #sonarqube-config-file}

You can modify the default configuration without using your own SonarQube instance. Create a `sonar-project.properties` file in the repo that you want to created the configuration file in. If our script detects an existing `configuration sonar-project.properties` file in the repo, it uses that file instead of the default file. For more information about possible analysis parameters in the configuration file, see [Analysis Parameters](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/analysis-parameters/){: external} here. 

Make sure that you add the correct login credentials and host URL to the configuration file.
{: important}

### Using another static scan implementation
{: #sonarqube-static-scan}

You can modify your `.pipeline-config.yaml` file to add your own custom script to the `static-scan` stage to use your own static scan implementation.

## Configuring SonarQube by using the API
{: #sonarqube-config-parameters}

The SonarQube tool integration supports the following configuration parameters that you can use with the [Toolchain HTTP API and SDKs](https://cloud.ibm.com/apis/toolchain){: external} when you [create](https://cloud.ibm.com/apis/toolchain#create-tool){: external}, [read](https://cloud.ibm.com/apis/toolchain#get-tool-by-id){: external}, and [update](https://cloud.ibm.com/apis/toolchain#update-tool){: external} tool integrations.

You must specify the `tool_type_id` property in the request body with the `sonarqube` value.
{: important}

| Parameter | Usage | Type | Terraform argument | Description |
| --- | --- | --- | --- | --- |
| blind_connection | optional, updatable, `Default: false` | Boolean | blind_connection | Set to `true` to instruct Continuous Delivery to ignore the configuration validation of this integration. Also, set to `true` if the SonarQube server is not addressable on the public internet. |
| dashboard_url | required, updatable | String | server_url | The URL of the SonarQube server dashboars for this tool integration. In the graphical UI, the browser goes to this dashboard when you click the SonarQube tool integration card. |
| name | required, updatable | String | name | The name of this tool integration. |
| user_login | optional, updatable | String | user_login | The user ID for authenticating with the SonarQube server. |
| user_password | optional, updatable | Password | user_password | The password or token to authenticate with the SonarQube server. You can use a toolchain secrets reference for this parameter. For more information about secrets references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_security&format=markdown#cd_secure_credentials). |
{: caption="SonarQube tool integration parameters" caption-side="bottom"}