SonarQube

SonarQube is a platform for continuous inspection of code quality. It performs automated reviews with static code analysis to detect bugs, code smells, and security vulnerabilities.

Sandbox SonarQube (https://sonarqube.mapsandbox.net/sonarqube/) is the primary location to view a service’s code quality. Depending on how a service’s build is configured, the build may reach out to SonarQube and fail if the quality gates are not met. This is usually configured for Release builds. Developers are encouraged to review a service’s findings in SonarQube to identify areas for improvement and fixes.

If you are using the latest settings.xml template, you can run a Sonar scan locally against the Sandbox Sonar instance with:

mvn -Psonar sonar:sonar -DskipTests

Quality Gates

The OCC Quality Gates define the thresholds that will result in a failed build. The following conditions on New Code will result in failure:

Condition	Threshold
Coverage on New Code	less than 80.0%
Duplicated Lines on New Code	greater than 3.0%
Maintainability Rating on New Code	worse than A
Reliability Rating on New Code	worse than A
Security Rating on New Code	worse than A

Condition

Threshold

Coverage on New Code

less than 80.0%

Duplicated Lines on New Code

greater than 3.0%

Maintainability Rating on New Code

worse than A

Reliability Rating on New Code

worse than A

Security Rating on New Code

worse than A

Because the quality gates apply to New Code, meeting them is primarily a matter of ensuring that the code you add or change is well tested, free of duplication, and clean of new bugs, code smells, and vulnerabilities.