SonarQube analysis

The PTB supports using SonarQube Cloud to analyze, visualize, & track linting, security, & coverage. All of our Python projects should be evaluated against the Exasol Way and subscribe to the Clean as You Code methodology. If code modified in a PR does not satisfy the aforementioned criteria, the SonarQube analysis fails.

The PTB includes instructions to set up a GitHub bot to display the results of the Sonar analysis in your pull requests as a stylized comment and workflow result. Section Configuration gives instructions for public and private repositories.

Configuration

Public GitHub repository

In GitHub

A GitHub Admin will need to:

  1. Inherit organization secret ‘SONAR_TOKEN’

  2. Activate the SonarQubeCloud App

  3. Post-merge: update the branch protections to include SonarQube analysis.

  • This should only be done when tests exist for the project, & that the project is at a state in which enforced code coverage would not be a burden. If you do not enact branch protections, it is recommended to create an issue to do so later.

In Sonar

  1. Create a project on SonarCloud

  • Project key should follow this pattern, e.g. com.exasol:python-toolbox

  • To alter the project further, you will need the help of a SonarQube Admin.

In the code

  1. Specify in the noxconfig.py the relative path to the project’s source code in Config.source
    source: Path = Path("exasol/<source-directory>")
  2. Add the following to the project’s file pyproject.toml
    [tool.sonar]
projectKey = "<sonar-project-key>"
host.url = "https://sonarcloud.io"
organization = "exasol"
exclusions = "<source-directory>/version.py,<source_directory>/<directory-to-ignore>/*"

Note

For more information, see the General remarks section.

Private GitHub repository

Note

As of 2025-07-29, these instructions have not been used. Thus, they should be scrutinized and refined when they are used to configure a private repository.

In GitHub

A GitHub Admin will need to:

  1. Add the individual ‘PRIVATE_SONAR_TOKEN’ to the ‘Organization secrets’

  2. Activate the exasonarqubeprchecks App

  3. Post-merge: update the branch protections to include SonarQube analysis.

  • This should only be done when tests exist for the project, & that the project is at a state in which enforced code coverage would not be a burden. If you do not enact branch protections, it is recommended to create an issue to do so later.

In Sonar

An IT Admin will need to:

  1. Create a project on https://sonar.exasol.com

  • Project key should follow this pattern, e.g. com.exasol:python-toolbox

In the code

  1. Specify in the noxconfig.py the relative path to the project’s source code in Config.source
    source: Path = Path("exasol/<source-directory>")
  2. Add the following to the project’s file pyproject.toml
    [tool.sonar]
projectKey = "com.exasol:<project-key>"
host.url = "https://sonar.exasol.com"
organization = "exasol"
exclusions = "<source-directory>/version.py,<source_directory>/<directory-to-ignore>/*"

Note

For more information, see the General remarks section.

General remarks

For additional configuration information, see Sonar’s analysis parameters page.

exclusions

With the value of exclusions, you can exclude files and directories of your project from Sonar’s analysis:

  • You can use wildcards, e.g. <root>/dir/*.py or <root>/**/*.py

  • Multiple exclusions can be comma-separated (as shown above).

  • For excluding arbitrary directories and files below a specific directory, please use two asterisks, e.g. root/abc/**.

See the Sonar Matching Patterns for more details.

By default, the nox session sonar:check only analyses the source code, as specified by the PROJECT_CONFIG.source, so directories outside of this are already excluded from being analyzed.