安装并使用sonar-scanner扫描仪

安装并使用sonar-scanner扫描仪

SonarScanner是在构建系统没有特定扫描仪时使用的扫描仪。

官方扫描仪，用于在SonarQube和SonarCloud上运行代码分析。从文件中读取项目配置sonar-project.properties或在命令行中传递项目配置。

安装分析仪

[root@localhost ~]# wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.2.0.1873-linux.zip
[root@localhost ~]# unzip sonar-scanner-cli-4.2.0.1873-linux.zip
[root@localhost ~]# mv sonar-scanner-4.2.0.1873-linux /usr/local/sonar-scanner
[root@localhost ~]# cd /usr/local/sonar-scanner
[root@localhost sonar-scanner]# ls
bin conf jre lib
[root@localhost sonar-scanner]# vim conf/sonar-scanner.properties
[root@localhost sonar-scanner]# grep -v “#” conf/sonar-scanner.properties
sonar.host.url=http://192.168.8.176:9002
sonar.sourceEncoding=UTF-8
sonar.jdbc.username=sonar
sonar.jdbc.password=hkkj@123
sonar.jdbc.url=jdbc:mysql:/192.168.8.176:3306/sonar?useUnicode=true&characterEncoding=utf8

配置环境变量

[root@localhost sonar-scanner]# vim /etc/profile
[root@localhost sonar-scanner]# tail -1 /etc/profile
export PATH=$PATH:/usr/local/sonar-scanner/bin
[root@localhost sonar-scanner]# source /etc/profile

验证安装

[root@localhost sonar-scanner]# sonar-scanner -v
INFO: Scanner configuration file: /usr/local/sonar-scanner/conf/sonar-scanner.properties
INFO: Project root configuration file: NONE
INFO: SonarQube Scanner 4.2.0.1873
INFO: Java 11.0.3 AdoptOpenJDK (64-bit)
INFO: Linux 3.10.0-957.el7.x86_64 amd64

使用扫描仪有两种方法，一种是命令行的方式，另一种是配置文件的方式，都简单介绍一下。

使用配置文件进行检测

创建令牌

创建令牌，并记录

设置配置文件

在项目的根目录下创建sonar-project.properties文件

[root@localhost java]# vim sonar-project.properties
[root@localhost java]# cat sonar-project.properties
sonar.projectKey=test1  #sonar平台中相对应项目的key
sonar.projectName=test1  #sonar平台中相对应项目的名字
sonar.projectVersion=master 
sonar.sources=./ #sonar检测的源文件目录，‘.’表示当前根目录下的所有文件目录;包含主要源文件的目录的逗号分隔路径
sonar.language=java #sonar检测的语言,该参数在sonar7.7被移除，如果使用的是7.7之前的版本就需要带这个参数
sonar.sourceEncoding=UTF-8  #所检测项目的字符编码
sonar.my.property=value 
sonar.java.binaries=target/squash-java-1.0.0-SNAPSHOT.jar

检测代码

[root@localhost test]# sonar-scanner

查看结果

使用命令行进行检测

创建令牌

test2: bf3f2f23154022eea7e016eeeb5762c4ffddf2e1

检测代码

将语言等一些配置直接写到/usr/local/sonar-scanner/conf/sonar-scanner.properties配置文件中
[root@localhost ~]# vim /usr/local/sonar-scannerconf/sonar-scanner.properties
sonar.language=java
sonar.sources=.
sonar.projectVersion=master
sonar.java.binaries=target/classes

然后在命令行执行命令：

sonar-scanner \
 -Dsonar.projectKey=test2 \
 -Dsonar.sources=. \
 -Dsonar.projectName=test2 \
 -Dsonar.host.url=http://192.168.8.176:9002 \
 -Dsonar.login=bf3f2f23154022eea7e016eeeb5762c4ffddf2e1

查看结果

遇到的问题

1.java版本不兼容

ERROR: Unable to create symbol table for : /test/java/src/main/java/com/squareup/squash/SquashEntry.java
java.lang.IllegalArgumentException: null
	at org.objectweb.asm.ClassReader.<init>(ClassReader.java:185)
	at org.objectweb.asm.ClassReader.<init>(ClassReader.java:168)
	at org.sonar.java.resolve.BytecodeCompleter.loadClass(BytecodeCompleter.java:228)
	at org.sonar.java.resolve.Symbols.<init>(Symbols.java:176)
	at org.sonar.java.resolve.SemanticModel.createFor(SemanticModel.java:58)
	at org.sonar.java.model.VisitorsBridge.visitFile(VisitorsBridge.java:101)
	at org.sonar.java.ast.JavaAstScanner.simpleScan(JavaAstScanner.java:96)
	at org.sonar.java.ast.JavaAstScanner.scan(JavaAstScanner.java:68)
	at org.sonar.java.JavaSquid.scanSources(JavaSquid.java:119)
	at org.sonar.java.JavaSquid.scan(JavaSquid.java:113)
	at org.sonar.plugins.java.JavaSquidSensor.execute(JavaSquidSensor.java:84)
	at org.sonar.scanner.sensor.SensorWrapper.analyse(SensorWrapper.java:53)
	at org.sonar.scanner.phases.SensorsExecutor.executeSensor(SensorsExecutor.java:88)
	at org.sonar.scanner.phases.SensorsExecutor.execute(SensorsExecutor.java:82)

解决办法：
报这个错是因为Java版本的不兼容造成的，在sonarqube页面，找到配置，应用市场，搜索sonarjava插件，将SonarJava更新到最新版本就好了。如图所示：

2.未找到编译项目

使用命令行时遇到

ERROR: Error during SonarQube Scanner execution
org.sonar.java.AnalysisException: Please provide compiled classes of your project with sonar.java.binaries property
	at org.sonar.java.JavaClasspath.init(JavaClasspath.java:64)
	at org.sonar.java.AbstractJavaClasspath.getElements(AbstractJavaClasspath.java:280)
	at org.sonar.java.SonarComponents.getJavaClasspath(SonarComponents.java:209)
	at org.sonar.java.JavaSquid.<init>(JavaSquid.java:84)
	at org.sonar.plugins.java.JavaSquidSensor.execute(JavaSquidSensor.java:87)
	at org.sonar.scanner.sensor.SensorWrapper.analyse(SensorWrapper.java:53)
	at org.sonar.scanner.phases.SensorsExecutor.executeSensor(SensorsExecutor.java:88)
	at org.sonar.scanner.phases.SensorsExecutor.execute(SensorsExecutor.java:82)
	at org.sonar.scanner.phases.SensorsExecutor.execute(SensorsExecutor.java:68)
	at org.sonar.scanner.phases.AbstractPhaseExecutor.execute(AbstractPhaseExecutor.java:88)
	at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart(ModuleScanContainer.java:177)
	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:135)
	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:121)
	at org.sonar.scanner.scan.ProjectScanContainer.scan(ProjectScanContainer.java:291)
	at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively(ProjectScanContainer.java:286)

解决办法：
在配置文件/usr/local/sonar-scanner/conf/sonar-scanner.properties中增加一行
sonar.java.binaries=target/classes
重新执行命令