SonarQube Integration with Jenkins

SonarQube integration in Jenkins runs code analysis after tests pass and optionally enforces a Quality Gate — a configured threshold for code coverage, bug count, code smell severity, or security vulnerability count — that fails the build if the gate is not met.

Pipeline integration steps

• Install the SonarQube Scanner plugin in Jenkins and configure a SonarQube server in Jenkins global configuration — this creates the withSonarQubeEnv binding that injects the server URL and token automatically
• withSonarQubeEnv('MySonarQube') { sh 'mvn sonar:sonar' } runs analysis and uploads results; the SonarQube token is stored as a Jenkins credential and injected by the binding — no hardcoded tokens in the Jenkinsfile
• Run analysis after mvn verify so the JaCoCo execution report exists; SonarQube reads the exec file to report coverage; running sonar before tests reports zero coverage

Quality Gate enforcement

• waitForQualityGate() after the analysis stage polls SonarQube for the Quality Gate result — SonarQube processes the results asynchronously, so the pipeline must wait before declaring success
• The Quality Gate is configured in SonarQube, not in the Jenkinsfile — the Jenkinsfile only calls waitForQualityGate(); the gate definition (coverage >= 80%, new bugs = 0, no critical vulnerabilities) lives in the SonarQube project settings
• waitForQualityGate abortPipeline: true fails the Jenkins build when the gate fails; without this the analysis runs but never blocks deployment — the most common misconfiguration in teams that want enforcement but do not actually get it

Branch and PR analysis

• SonarQube Developer Edition and above supports branch analysis — each feature branch gets its own SonarQube analysis separate from the main branch, enabling PR Quality Gate decoration directly in the pull request interface
• Configure the sonar.pullrequest.key, sonar.pullrequest.branch, and sonar.pullrequest.base properties in the PR-triggered pipeline to enable inline code review comments from SonarQube on the pull request diff