sonar-scanner
SonarQube static code analysis scanner
TLDR
SYNOPSIS
sonar-scanner [-D property=value] [-X] [options]
DESCRIPTION
sonar-scanner performs static analysis for SonarQube/SonarCloud. It scans code for bugs, vulnerabilities, and code smells.Configuration via properties or file. sonar-project.properties defines project.Analysis results upload to server. Web interface shows findings.Multiple languages supported. Java, JavaScript, Python, and many others.CI integration automates scanning. Run on every build or pull request.
PARAMETERS
-D PROPERTY=VALUE
Set property.-X, --debug
Debug output.-h, --help
Show help.-v, --version
Show version.
CONFIGURATION
sonar-project.properties
Project-level configuration file defining project key, source directories, language, and exclusion patterns.SONAR_TOKEN
Environment variable for authentication token to SonarQube or SonarCloud.SONAR_HOST_URL
Environment variable specifying the SonarQube server URL.
PROPERTIES
sonar.projectKey - Project identifiersonar.host.url - Server URLsonar.token - Authentication token (replaces deprecated sonar.login)sonar.sources - Source directoriessonar.language - Languagesonar.exclusions - Exclude patternssonar.inclusions - Include patternssonar.sourceEncoding - Source file encoding (default: system encoding)sonar.verbose - Enable verbose output (true/false)
INSTALL
CAVEATS
Requires SonarQube/Cloud instance. Token needed for upload. Large projects take time.
HISTORY
SonarQube was created by SonarSource for continuous code quality. The scanner is the analysis client that sends data to the server.
