SonarQube: Scanning and Quality Gates in CI

Create a project in SonarQube, then a token (My Account, Security). Store it as a CI secret.

sonar-project.properties:

sonar.projectKey=shop-api
sonar.sources=src
sonar.tests=test
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.exclusions=**/node_modules/**,**/*.spec.ts

Run the scanner (Docker avoids installing it):

docker run --rm -e SONAR_HOST_URL=https://sonar.example.com -e SONAR_TOKEN=$SONAR_TOKEN \
  -v "$PWD:/usr/src" sonarsource/sonar-scanner-cli:5.0

In a Jenkins pipeline, with the SonarQube plugin configured:

stage('Sonar') {
  steps { withSonarQubeEnv('sonar') { sh 'sonar-scanner' } }
}
stage('Quality Gate') {
  steps { timeout(time: 5, unit: 'MINUTES') { waitForQualityGate abortPipeline: true } }
}

The default Sonar way gate fails on new bugs, vulnerabilities, low coverage on new code, and duplication. It judges new code, so legacy debt does not block every change. The waitForQualityGate step needs a webhook from SonarQube to Jenkins.