使用Jenkins 集成 SonarQube 可以让jenkins在发布项目时扫描代码,将漏洞展示在sonarqube上
条件:已经安装好jenkins和sonarqube
安装SonarQube Scanner插件
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-63-1024x153.png)
配置SonarQube
首先,在SonarQube中生成一个Token(PS:用token代替输入用户名和密码)
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-64.png)
然后,在Jenkins中配置连接sonarqube服务器的地址,这里用到的token就是刚才在sonarqube中创建的那个token
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-65-1024x316.png)
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-66-1024x288.png)
在全局工具配置中添加
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-67-1024x326.png)
在项目中添加
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-68-1024x494.png)
java项目
sonar.projectKey=$JOB_NAME
sonar.projectName=$JOB_NAME
sonar.projectVersion=1.0
sonar.language=java
sonar.sourceEncoding=UTF-8
sonar.sources=$WORKSPACE
sonar.java.binaries=$WORKSPACE
python项目
sonar.projectName=$JOB_NAME
sonar.projectVersion=1.0
sonar.sources=$WORKSPACE/test
sonar.sourceEncoding=UTF-8
sonar.langeage=py
sonar.python.coverage.reportPath=/root/.jenkins/workspace/pyUnit/test/coverage.xml
![](https://www.wmmzz.com/wp-content/uploads/2021/02/image-69-1024x217.png)
参考文献:
https://www.cnblogs.com/cjsblog/archive/2019/04/20/10740840.html