1. 环境介绍

1.1. git仓库

git仓库采用gitlab，后续当介绍到其他内容时，使用gitea。

创建一个demo的java代码项目，并将代码上传到gitlab仓库，效果如下

2. 建立SonarQube项目

2.1. gitlab准备工作

2.1.1. gitlab访问令牌

• 注意到期时间
• 接口权限范围只需要read_api和api即可
• 令牌创建完成之后token要保存，否则之后界面上无法找到的

2.2. SonarQube创建项目

2.2.1. 创建项目

选择Import from GitLab

2.2.2. 输入GitLab项目信息

2.2.3. 选择gitlab项目

2.2.4. 创建项目

2.2.5. 本地使用并创建SonarQube令牌

2.2.6. 获取SonarQube本地扫描内容

mvn clean verify sonar:sonar   -Dsonar.projectKey=java_tool_geotoolsinput   -Dsonar.projectName='geotoolsInput'   -Dsonar.host.url=http://192.168.152.134:9000   -Dsonar.token=sqp_437d1cb4b65080bad63f49a4ae244c82b4ba1390

3. 触发代码检查

3.1. 手动触发前置条件

由于手动触发要求java版本必须要jdk11以上，也需要通过maven触发（如果是采用其他的方法构建，按照SonarQube界面会有指导信息）

C:\Users\caimingyang>java -version
java version "17.0.12" 2024-07-16 LTS
Java(TM) SE Runtime Environment (build 17.0.12+8-LTS-286)
Java HotSpot(TM) 64-Bit Server VM (build 17.0.12+8-LTS-286, mixed mode, sharing)

C:\Users\caimingyang>mvn --version
Apache Maven 3.8.8 (4c87b05d9aedce574290d1acc98575ed5eb6cd39)
Maven home: D:\Software\apache-maven-3.8.8
Java version: 17.0.12, vendor: Oracle Corporation, runtime: D:\Software\Java\Java17
Default locale: zh_CN, platform encoding: GBK
OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"

3.2. 获取项目的操作Token信息

mvn clean verify sonar:sonar   -Dsonar.projectKey=java_tool_geotoolsinput_b98089cb-632a-41c8-adc0-0bba35ed9f54   -Dsonar.projectName='geotoolsInput'   -Dsonar.host.url=http://192.168.152.134:9000   -Dsonar.token=sqp_437d1cb4b65080bad63f49a4ae244c82b4ba1390

3.3. 触发代码检查

F:\Code\Java\geotoolsInput>mvn clean verify sonar:sonar   -Dsonar.projectKey=java_tool_geotoolsinput_b98089cb-632a-41c8-adc0-0bba35ed9f54   -Dsonar.projectName='geotoolsInput'   -Dsonar.host.url=http://192.168.152.134:9000   -Dsonar.token=sqp_437d1cb4b65080bad63f49a4ae244c82b4ba1390
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------------< org.example:geotoolsInput >----------------------
[INFO] Building geotoolsInput 1.0-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-clean-plugin:2.5:clean (default-clean) @ geotoolsInput ---
[INFO] Deleting F:\Code\Java\geotoolsInput\target
[INFO]
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ geotoolsInput ---
[WARNING] Using platform encoding (GBK actually) to copy filtered resources, i.e. build is platform dependent!
[INFO] Copying 0 resource
[INFO]
[INFO] --- maven-compiler-plugin:3.1:compile (default-compile) @ geotoolsInput ---
[INFO] Changes detected - recompiling the module!
[WARNING] File encoding has not been set, using platform encoding GBK, i.e. build is platform dependent!
[INFO] Compiling 5 source files to F:\Code\Java\geotoolsInput\target\classes
[WARNING] /F:/Code/Java/geotoolsInput/src/main/java/ConnPostgis.java: 有关详细信息, 请使用 -Xlint:removal 重新编译。
[INFO]
[INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ geotoolsInput ---
[WARNING] Using platform encoding (GBK actually) to copy filtered resources, i.e. build is platform dependent!
[INFO] skip non existing resourceDirectory F:\Code\Java\geotoolsInput\src\test\resources
[INFO]
[INFO] --- maven-compiler-plugin:3.1:testCompile (default-testCompile) @ geotoolsInput ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- maven-surefire-plugin:2.12.4:test (default-test) @ geotoolsInput ---
[INFO] No tests to run.
[INFO]
[INFO] --- maven-jar-plugin:2.4:jar (default-jar) @ geotoolsInput ---
[INFO] Building jar: F:\Code\Java\geotoolsInput\target\geotoolsInput-1.0-SNAPSHOT.jar
[INFO]
[INFO] ---------------------< org.example:geotoolsInput >----------------------
[INFO] Building geotoolsInput 1.0-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- sonar-maven-plugin:4.0.0.4121:sonar (default-cli) @ geotoolsInput ---
[WARNING] 18:01:34.515 Using an unspecified version instead of an explicit plugin version may introduce breaking analysis changes at an unwanted time. It is highly recommended to use an explicit version, e.g. 'org.sonarsource.scanner.maven:sonar-maven-plugin:4.0.0.4121'.
[INFO] 18:01:34.529 Java 17.0.12 Oracle Corporation (64-bit)
[INFO] 18:01:34.529 Windows 11 10.0 (amd64)
[INFO] 18:01:34.633 User cache: C:\Users\caimingyang\.sonar\cache
[INFO] 18:01:34.766 Communicating with SonarQube Server 25.11.0.114957
[INFO] 18:01:34.821 Default locale: "zh_CN", source code encoding: "GBK" (analysis is platform dependent)
[INFO] 18:01:35.530 Load global settings
[INFO] 18:01:35.593 Load global settings (done) | time=65ms
[INFO] 18:01:35.611 Server id: 4F833BF3-AZsq8OxMGlMwweWYxK5m
[INFO] 18:01:35.623 Loading required plugins
[INFO] 18:01:35.623 Load plugins index
[INFO] 18:01:35.656 Load plugins index (done) | time=33ms
[INFO] 18:01:35.656 Load/download plugins
[INFO] 18:01:35.670 Load/download plugins (done) | time=14ms
[INFO] 18:01:36.096 Process project properties
[INFO] 18:01:36.175 Process project properties (done) | time=79ms
[INFO] 18:01:36.212 Project key: java_tool_geotoolsinput_b98089cb-632a-41c8-adc0-0bba35ed9f54
[INFO] 18:01:36.212 Base dir: F:\Code\Java\geotoolsInput
[INFO] 18:01:36.212 Working dir: F:\Code\Java\geotoolsInput\target\sonar
[INFO] 18:01:36.242 Load project settings for component key: 'java_tool_geotoolsinput_b98089cb-632a-41c8-adc0-0bba35ed9f54'
[INFO] 18:01:36.263 Load project settings for component key: 'java_tool_geotoolsinput_b98089cb-632a-41c8-adc0-0bba35ed9f54' (done) | time=20ms
[INFO] 18:01:36.288 Load quality profiles
[INFO] 18:01:36.362 Load quality profiles (done) | time=74ms
[INFO] 18:01:36.424 Load active rules
[INFO] 18:01:36.728 Load active rules (done) | time=304ms
[INFO] 18:01:36.734 Load analysis cache
[INFO] 18:01:36.746 Load analysis cache (404) | time=12ms
[INFO] 18:01:36.900 Preprocessing files...
[INFO] 18:01:37.142 2 languages detected in 6 preprocessed files (done) | time=241ms
[INFO] 18:01:37.142 0 files ignored because of scm ignore settings
[INFO] 18:01:37.145 Loading plugins for detected languages
[INFO] 18:01:37.145 Load/download plugins
[INFO] 18:01:37.156 Load/download plugins (done) | time=11ms
[INFO] 18:01:37.311 Load project repositories
[INFO] 18:01:37.484 Load project repositories (done) | time=173ms
[INFO] 18:01:37.495 Indexing files...
[INFO] 18:01:37.495 Project configuration:
[INFO] 18:01:37.506 6 files indexed (done) | time=11ms
[INFO] 18:01:37.507 Quality profile for java: Sonar way
[INFO] 18:01:37.508 Quality profile for xml: Sonar way
[INFO] 18:01:37.508 ------------- Run sensors on module 'geotoolsInput'
[INFO] 18:01:37.595 Load metrics repository
[INFO] 18:01:37.627 Load metrics repository (done) | time=32ms
[INFO] 18:01:38.677 Sensor JavaSensor [java]
[INFO] 18:01:38.682 Configured Java source version (sonar.java.source): 8, preview features enabled (sonar.java.enablePreview): false
[INFO] 18:01:38.734 Server-side caching is enabled. The Java analyzer will not try to leverage data from a previous analysis.
[INFO] 18:01:38.737 Using ECJ batch to parse 5 Main java source files with batch size 420 KB.
[INFO] 18:01:38.996 Starting batch processing.
[INFO] 18:01:39.354 The Java analyzer cannot skip unchanged files in this context. A full analysis is performed for all files.
[INFO] 18:01:43.342 100% analyzed
[INFO] 18:01:43.342 Batch processing: Done.
[INFO] 18:01:43.350 Did not optimize analysis for any files, performed a full analysis for all 5 files.
[INFO] 18:01:43.356 No "Test" source files to scan.
[INFO] 18:01:43.357 No "Generated" source files to scan.
[INFO] 18:01:43.360 Sensor JavaSensor [java] (done) | time=4684ms
[INFO] 18:01:43.360 Sensor SurefireSensor [java]
[INFO] 18:01:43.362 parsing [F:\Code\Java\geotoolsInput\target\surefire-reports]
[INFO] 18:01:43.364 Sensor SurefireSensor [java] (done) | time=4ms
[INFO] 18:01:43.364 Sensor XML Sensor [xml]
[INFO] 18:01:43.377 1 source file to be analyzed
[INFO] 18:01:43.597 1/1 source file has been analyzed
[INFO] 18:01:43.597 Sensor XML Sensor [xml] (done) | time=233ms
[INFO] 18:01:43.597 Sensor JaCoCo XML Report Importer [jacoco]
[INFO] 18:01:43.598 'sonar.coverage.jacoco.xmlReportPaths' is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
[INFO] 18:01:43.599 No report imported, no coverage information will be imported by JaCoCo XML Report Importer
[INFO] 18:01:43.599 Sensor JaCoCo XML Report Importer [jacoco] (done) | time=2ms
[INFO] 18:01:43.599 Sensor IaC Docker Sensor [iac]
[INFO] 18:01:43.601 There are no files to be analyzed for the Docker language
[INFO] 18:01:43.601 Sensor IaC Docker Sensor [iac] (done) | time=2ms
[INFO] 18:01:43.601 Sensor IaC hadolint report Sensor [iac]
[INFO] 18:01:43.604 Sensor IaC hadolint report Sensor [iac] (done) | time=3ms
[INFO] 18:01:43.604 Sensor Java Config Sensor [iac]
[INFO] 18:01:43.612 There are no files to be analyzed for the Java language
[INFO] 18:01:43.612 Sensor Java Config Sensor [iac] (done) | time=8ms
[INFO] 18:01:43.612 Sensor TextAndSecretsSensor [text]
[INFO] 18:01:43.629 Available processors: 32
[INFO] 18:01:43.630 Using 32 threads for analysis.
[INFO] 18:01:44.027 Start fetching files for the text and secrets analysis
[INFO] 18:01:44.196 Using Git CLI to retrieve untracked files
[INFO] 18:01:44.260 Retrieving language associated files and files included via "sonar.text.inclusions" that are tracked by git
[INFO] 18:01:44.261 Starting the text and secrets analysis
[INFO] 18:01:44.262 6 source files to be analyzed for the text and secrets analysis
[INFO] 18:01:44.316 6/6 source files have been analyzed for the text and secrets analysis
[INFO] 18:01:44.321 Sensor TextAndSecretsSensor [text] (done) | time=709ms
[INFO] 18:01:44.336 ------------- Run sensors on project
[INFO] 18:01:44.444 Sensor JavaProjectSensor [java]
[INFO] 18:01:44.445 Sensor JavaProjectSensor [java] (done) | time=1ms
[INFO] 18:01:44.446 Sensor Zero Coverage Sensor
[INFO] 18:01:44.460 Sensor Zero Coverage Sensor (done) | time=14ms
[INFO] 18:01:44.460 Sensor Java CPD Block Indexer
[INFO] 18:01:44.480 Sensor Java CPD Block Indexer (done) | time=20ms
[INFO] 18:01:44.480 ------------- Gather SCA dependencies on project
[INFO] 18:01:44.482 Dependency analysis skipped
[INFO] 18:01:44.484 SCM Publisher SCM provider for this project is: git
[INFO] 18:01:44.487 SCM Publisher 6 source files to be analyzed
[INFO] 18:01:45.029 SCM Publisher 6/6 source files have been analyzed (done) | time=542ms
[INFO] 18:01:45.032 CPD Executor 1 file had no CPD blocks
[INFO] 18:01:45.032 CPD Executor Calculating CPD for 4 files
[INFO] 18:01:45.043 CPD Executor CPD calculation finished (done) | time=10ms
[INFO] 18:01:45.050 SCM revision ID '82c226ef01ea8d493283104b10414f0714ebb4ac'
[INFO] 18:01:45.163 Analysis report generated in 104ms, dir size=344.5 kB
[INFO] 18:01:45.273 Analysis report compressed in 109ms, zip size=60.2 kB
[INFO] 18:01:45.309 Analysis report uploaded in 36ms
[INFO] 18:01:45.313 ANALYSIS SUCCESSFUL, you can find the results at: http://192.168.152.134:9000/dashboard?id=java_tool_geotoolsinput_b98089cb-632a-41c8-adc0-0bba35ed9f54
[INFO] 18:01:45.314 Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
[INFO] 18:01:45.314 More about the report processing at http://192.168.152.134:9000/api/ce/task?id=5deb24cd-755b-4202-8b2b-341e2c8be337
[INFO] 18:01:45.374 Analysis total time: 9.661 s
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:39 min
[INFO] Finished at: 2025-12-17T18:01:45+08:00
[INFO] ------------------------------------------------------------------------

3.4. 检查结果信息