How to do Sonar scan for Java Maven Project

 Below are the steps to run Sonar o Maven based Java Project

1. Install SonarQube server

2. Add below pluin dependency in application pom.xml:

   <plugin>

             <groupId>org.sonarsource.scanner.maven</groupId>

             <artifactId>sonar-maven-plugin</artifactId>

             <version>3.7.0.1746</version>

   </plugin>

3. In case you app running on JDK 8 & SonarQube on different JDK, then do the maven clean install in JDK8 & run sonar command in JDK 17

(e.g. export JAVA_HOME=/<Corretto Path>/corretto-17 before running sonar command)

4. Add below plugin in pom.xml to get dependency check report

   <plugin>

                <groupId>org.owasp</groupId>

                <artifactId>dependency-check-maven</artifactId>

                <version>8.4.0</version>

                <executions>

                    <execution>

                        <goals>

                            <goal>check</goal>

                        </goals>

                    </execution>

                </executions>

                <configuration>

                    <formats>

                        <format>XML</format>

                        <format>JSON</format>

                        <format>HTML</format>

                    </formats>

                    <!--<outputDirectory>${project.build.directory}/dependency-check-report</outputDirectory>-->

                </configuration>

    </plugin>

5. Run below command

mvn sonar:sonar  -Dsonar.token=<sonar_token> -Dsonar.scm.disabled=true -Dsonar.projectKey=<project key name> -Dsonar.dependencyCheck.reportPath=target/dependency-check-report.xml -Dsonar.dependencyCheck.jsonReportPath=target/dependency-check-report.json -Dsonar.dependencyCheck.htmlReportPath=target/dependency-check-report.html

N.B. OWASP Dependency Check Plugin can be integrated to Sonar Server from Sonar Marketplace. Sonar Marketplace is visible from Admin section of the SonarQube server installed in your system.