sonar-scanner

Run analysis

$ sonar-scanner

$ sonar-scanner -Dsonar.projectKey=[myproject]

$ sonar-scanner -Dsonar.host.url=[http://localhost:9000]

$ sonar-scanner -Dsonar.login=[token]

$ sonar-scanner -Dsonar.sources=[src]

$ sonar-scanner -X

$ sonar-scanner -Dproject.settings=[sonar-project.properties]

sonar-scanner [-D property=value] [-X] [options]

sonar-scanner performs static analysis for SonarQube/SonarCloud. It scans code for bugs, vulnerabilities, and code smells.
Configuration via properties or file. sonar-project.properties defines project.
Analysis results upload to server. Web interface shows findings.
Multiple languages supported. Java, JavaScript, Python, and many others.
CI integration automates scanning. Run on every build or pull request.

-D PROPERTY=VALUE

Set property.

Debug output.

Show help.

Show version.

sonar-project.properties

Project-level configuration file defining project key, source directories, language, and exclusion patterns.

Environment variable for authentication token to SonarQube or SonarCloud.

Environment variable specifying the SonarQube server URL.

sonar.projectKey - Project identifier
sonar.host.url - Server URL
sonar.login - Auth token
sonar.sources - Source directories
sonar.language - Language
sonar.exclusions - Exclude patterns

Requires SonarQube/Cloud instance. Token needed for upload. Large projects take time.

SonarQube was created by SonarSource for continuous code quality. The scanner is the analysis client that sends data to the server.

sonarqube(1), eslint(1), phpstan(1)