How to do Sonar scan for Java Maven Project

 Below are the steps to run Sonar o Maven based Java Project

1. Install SonarQube server

2. Add below pluin dependency in application pom.xml:

   <plugin>

             <groupId>org.sonarsource.scanner.maven</groupId>

             <artifactId>sonar-maven-plugin</artifactId>

             <version>3.7.0.1746</version>

   </plugin>

3. In case you app running on JDK 8 & SonarQube on different JDK, then do the maven clean install in JDK8 & run sonar command in JDK 17

(e.g. export JAVA_HOME=/<Corretto Path>/corretto-17 before running sonar command)

4. Add below plugin in pom.xml to get dependency check report

   <plugin>

                <groupId>org.owasp</groupId>

                <artifactId>dependency-check-maven</artifactId>

                <version>8.4.0</version>

                <executions>

                    <execution>

                        <goals>

                            <goal>check</goal>

                        </goals>

                    </execution>

                </executions>

                <configuration>

                    <formats>

                        <format>XML</format>

                        <format>JSON</format>

                        <format>HTML</format>

                    </formats>

                    <!--<outputDirectory>${project.build.directory}/dependency-check-report</outputDirectory>-->

                </configuration>

    </plugin>

5. Run below command

mvn sonar:sonar  -Dsonar.token=<sonar_token> -Dsonar.scm.disabled=true -Dsonar.projectKey=<project key name> -Dsonar.dependencyCheck.reportPath=target/dependency-check-report.xml -Dsonar.dependencyCheck.jsonReportPath=target/dependency-check-report.json -Dsonar.dependencyCheck.htmlReportPath=target/dependency-check-report.html

N.B. OWASP Dependency Check Plugin can be integrated to Sonar Server from Sonar Marketplace. Sonar Marketplace is visible from Admin section of the SonarQube server installed in your system. 

SonarQube Postgres Installation

SonarQube with JDK 17 & Postgres as DB backend

DB:

Install Postgres Server 16.x

Execute the below SQL Script from Postgres DB:

CREATE USER sonar ;

ALTER USER sonar WITH PASSWORD 'sonar';

CREATE DATABASE sonardb WITH ENCODING 'UTF8';

ALTER DATABASE sonardb OWNER TO sonar;

SonarQube:

Add SONAR_JAVA_PATH in Environment variable  with value like below <Java_Path>\Java\jdk17.0.8_8\bin\javaw.exe

In sonar.properties 

1. Update JDBC url

sonar.jdbc.url=jdbc:postgresql://localhost:5432/sonardb?currentSchema=public

2. Update the below 2 properties too

sonar.jdbc.username=sonar

sonar.jdbc.password=sonar

Once done with above steps; 

Navigate to <Sonar Path>\sonarqube-10.2.1.78527\bin\windows-x86-64

From Command prompt type StartSonar.bat to start

Sonar should be accessible:

http://localhost:9000/