SonarQube Analysis#

The PTB supports using SonarQube Cloud to analyze, visualize, and track linting, security, and coverage results that PTB uploads via sonar:check.

All of our Python projects should be evaluated against the Exasol Way and subscribe to the Clean as You Code methodology. If code modified in a pull request does not satisfy the configured criteria, the Sonar analysis fails.

The PTB workflow report.yml runs sonar:check after the linting and test jobs have produced their artifacts. For the end-to-end PTB code-quality flow, see Measuring Code Quality.

Configuration#

To use Sonar with PTB, configure:

  • GitHub access and secrets

  • the Sonar project

  • the project-specific Sonar settings in pyproject.toml and noxconfig.py

Public GitHub Repository#

In GitHub#

A GitHub Admin will need to:

  1. Inherit organization secret ‘SONAR_TOKEN’

  2. Activate the SonarQubeCloud App

  3. Post-merge: update the branch protections to include SonarQube analysis.

  • This should only be done when tests exist for the project, & that the project is at a state in which enforced code coverage would not be a burden. If you do not enact branch protections, it is recommended to create an issue to do so later.

In Sonar#

  1. Create a project on SonarCloud

  • Project key should follow this pattern, e.g. com.exasol:python-toolbox

  • To alter the project further, you will need the help of a SonarQube Admin.

In the Code#

  1. In noxconfig.py, the relative path to the project’s source code is defined with Config.sonar_code_path.

  2. Add the following to the project’s file pyproject.toml
    [tool.sonar]
projectKey = "<sonar-project-key>"
host.url = "https://sonarcloud.io"
organization = "exasol"
exclusions = "<source_code_directory>/<directory-to-ignore>/*"

Note

For more information, see the General remarks section.

Private GitHub Repository#

See the company wiki for details on how to use Exasol’s on-prem SonarQube cluster and the needed steps to configure for a private GitHub repository.

Note

For more general information, see the General remarks section.

General Remarks#

For additional configuration information, see Sonar’s analysis parameters page.

Exclude Files from SonarQube Static Code Analysis#

With the value of exclusions, you can exclude files and directories of your project from Sonar’s analysis:

  • You can use wildcards, e.g. <root>/dir/*.py or <root>/**/*.py

  • Multiple exclusions can be comma-separated (as shown above).

  • For excluding arbitrary directories and files below a specific directory, please use two asterisks, e.g. root/abc/**.

See the Sonar Matching Patterns for more details.

The Nox session sonar:check only analyses the source code, as specified by the PROJECT_CONFIG.sonar_code_path, so directories outside of this are already excluded from being analyzed by default.