sonarqube-scan
Run SonarQube/SonarCloud static code analysis to check code quality, detect security vulnerabilities, code smells, and bugs. Use when the user mentions SonarQube, code quality analysis, security scanning, static analysis, or wants to check for vulnerabilities.
When & Why to Use This Skill
This Claude skill integrates SonarQube and SonarCloud static code analysis into your development workflow to automate code quality inspections. It proactively detects security vulnerabilities, code smells, and bugs in Python applications, providing developers with actionable insights into technical debt and code coverage to maintain high engineering standards.
Use Cases
- Automated Security Auditing: Scan Python web applications for security vulnerabilities and potential exploits to ensure software safety and compliance.
- Technical Debt Management: Identify code smells, complex logic, and duplicated code to improve maintainability and reduce long-term development costs.
- Continuous Quality Inspection: Generate detailed reports on code quality metrics and bugs during the development process to catch issues before they reach production.
- Code Coverage Tracking: Analyze and review test coverage results to ensure critical paths in the codebase are properly tested and verified.
| name | sonarqube-scan |
|---|---|
| description | Run SonarQube/SonarCloud static code analysis to check code quality, detect security vulnerabilities, code smells, and bugs. Use when the user mentions SonarQube, code quality analysis, security scanning, static analysis, or wants to check for vulnerabilities. |
| allowed-tools | Bash, Read, Grep |
SonarQube Code Analysis
This skill runs SonarQube/SonarCloud scans on your Python web application to analyze code quality, detect security vulnerabilities, and identify code smells.
When to Use This Skill
Use this skill when you need to:
- Run a SonarQube or SonarCloud scan
- Check code quality metrics
- Find security vulnerabilities
- Detect code smells and bugs
- Generate static analysis reports
- Review code coverage and technical debt
Prerequisites
Before running a scan, ensure:
- Python and pip are installed
- Project is configured with SonarQube/SonarCloud credentials
- Internet connection is available for uploading results
How to Run a Scan
Windows (PowerShell)
Run the PowerShell script:
powershell.exe -ExecutionPolicy Bypass -File .claude/skills/sonarqube/scripts/run_sonar_scan.ps1
Linux/Mac (Bash)
Run the bash script:
bash .claude/skills/sonarqube/scripts/run_sonar_scan.sh
What the Scan Does
- Installs pysonar - Automatically installs the SonarQube scanner for Python
- Runs analysis - Scans all Python files in the project
- Uploads results - Sends results to SonarCloud for analysis
- Generates report - Creates a detailed quality report with:
- Code quality metrics
- Security vulnerabilities
- Code smells
- Bugs and issues
- Technical debt
- Code coverage
Understanding Results
After the scan completes:
- Visit your SonarCloud dashboard to view results
- Check the console output for immediate feedback
- Look for critical issues flagged during the scan
For detailed configuration options, see REFERENCE.md.
Troubleshooting
Issue: pysonar installation fails
- Check your Python and pip installation
- Ensure you have internet connectivity
- Try manually installing:
pip install pysonar
Issue: Authentication error
- Verify your SonarQube token is valid
- Check project key and organization are correct
- See REFERENCE.md for credential configuration
Issue: Scan timeout
- Large projects may take several minutes
- Check network connectivity
- Review SonarCloud service status
Next Steps After Scanning
- Review the SonarCloud dashboard
- Address critical security issues first
- Fix bugs and code smells
- Monitor code quality trends over time
- Integrate into CI/CD pipeline for automated scanning