# Sonarqube

SonarQube is a self-managed, automatic code review tool that systematically helps in delivering clean code. 

### Usage of Sonarqube in Delivery Shield

* Delivery Shield can mandate security scans on code repos using Sonarqube. It connects with Sonarqube to see if the required code repository has been scanned by and if not done, Delivery Shield generates a security issue.
* Once the Sonarqube scan is done, Delivery Shield pulls the SAST scan results from and uses to  calculate the overall image and application risk scoring. 
* The scanned results are available in the [Vulnerability Management](https://docs.opsmx.com/opsmx-secure-software-delivery-ssd-platform/user-guide/vulnerability-management) page, **Source** section of the [DBOM](https://docs.opsmx.com/opsmx-secure-software-delivery-ssd-platform/user-guide/delivery-bill-of-materials-dbom) page, and the [View Open Security Issues](https://docs.opsmx.com/opsmx-secure-software-delivery-ssd-platform/user-guide/view-security-posture/view-open-security-issues) page.
* Users can also create custom policies based on the SAST scan results, for example, users can create a policy that blocks images built from a repository where the Sonarqube quality gate check failed at the time of build.

### To Integrate Sonarqube:

1. Navigate to **Setup** > **Integrations**.
2. In the **Source** panel, click on Sonarqube.

<figure><img src="https://2047464521-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBEa1hoX6SqpDj-ymNs%2Fuploads%2FiJFHe4UuMlZaJ4AQRicT%2Fsonarqube%201.png?alt=media&#x26;token=3c3a7882-3acf-4a6f-a820-bc7e92915097" alt=""><figcaption></figcaption></figure>

3. The Sonarqube integration page is displayed. Click **+New Account**.&#x20;

<figure><img src="https://2047464521-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBEa1hoX6SqpDj-ymNs%2Fuploads%2FocztCbMAopEkkIqQjxsh%2Fimage.png?alt=media&#x26;token=e4120edc-81b4-4fe6-89bb-ee0bd113043c" alt=""><figcaption></figcaption></figure>

4. In the popup that appears, enter the **Account Name**, **URL** and **Token** values of your Sonarqube account. (See [Token](https://docs.sonarsource.com/sonarqube/latest/user-guide/user-account/generating-and-using-tokens/) for details on how to generate API token).&#x20;
5. Enable **Sonarqube File Insertion** if required.&#x20;
6. Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.&#x20;

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can select up to 5 teams for the integration to be displayed. </p></div>

   * An example is given below for reference:

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeuMZQzZsZQuulVdW9B9OuffNPoEXqbcpcAkYtKVyb7YiTQxbVIt1L4Gh-zshqX2J9MFKIat8x4oWFIGxdg3j1XVagyUNhUAlD_52soyMyd1cy53p6XiYi0LsTjIBfHcybRWl61?key=D9EXoOdGF7oYOBvYaW2GnRWJ" alt=""><figcaption></figcaption></figure>

   * In the example above,&#x20;
     * if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account.
     * Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**.&#x20;
     * Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation.
   * **For Organization Admins:**
     * When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default.
   * **For Team Admins with Multiple Teams:**
     * If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
7. Click **Save**. The tool is integrated in the source stage.&#x20;
8. You can edit the entered values by clicking the **Edit** option as shown below:
9. Enter the new URL and token value and click **Update**.&#x20;

The new values get updated.&#x20;

\
\
\ <br>