Detect Bugs & Vulnerabilities and get instant feedback. Lumen - Sonarcloud Integration
Tags: laravel, sonarcloud, vulnerabilities, security
Published: 2023-08-25 07:21:41

## What is Sonarcloud ?
SonarCloud is a cloud-based code analysis service designed to detect coding issues in 26 different programming languages. By integrating directly with your CI pipeline or one of our supported DevOps platforms, your code is checked against an extensive set of rules that cover many attributes of code, such as maintainability, reliability, and security issues on each merge/pull request. As a core element of our Sonar solution, SonarCloud completes the analysis loop to help you deliver clean code that meets high-quality standards.

![Dev Cycle](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7nwe3uwz1a16fige8iys.png)

SonarCloud uses state-of-the-art techniques in static code analysis to find problems and potential problems in the code that you and your team write. Static analysis is called static because it does not rely on actually running the code.  As a result, SonarCloud offers an additional layer of verification, different from automated testing and manual code review. Its powerful set of language-specific analyzers uses thousands of rules to track down hard-to-find bugs and quality issues - from simple coding mistakes, and tricky bugs, to advanced issues and security vulnerabilities such as injection flaws. Early detection of problems during static analysis ensures that fewer issues get through to the later stages of the process and ultimately helps to increase the overall quality of your production code. 

As a core element of our Sonar solution, SonarCloud integrates into your existing workflow and detects issues in your code to help you perform continuous code inspections of your projects. It achieves this by integrating into your CI pipeline or DevOps platform thus, extending your DevOps experience by importing your projects and performing automated code checks within minutes. SonarCloud works with:

- Github
- Bitbucket Cloud
- Azure DevOps
- Gitlab

SonarCloud does not work with on-premises code repositories. For on-premise support.

In this tutorial, i would like to tell you how to integrated Sonarcloud. Make simple dev-cylce (Laravel, Gitlab, and Sonarcloud)

## Create Workspace / Project Group in Gitlab

- Open and sign in to your Gitlab account https://gitlab.com/users/sign_in 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0d77jmgzuf2kxsk30t5q.png)

- On the sidebar, click "Group"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p0hmynx0rcvvtj2vsgzi.png)

- Click "New Group" button (if you want to make new project group)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/grxz4ig1chuc0feaw0k6.png)

- Click "Create Group"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b0bbdttg1dy28lgdliva.png)

- Fill out the form, choose your permission access for your workspace (public / private), in this tutorial i will choose "public", and submit "Create Group"

- Sonarcloud need personal access token from your Gitlab account. So, you have to generate your token, open your account setting menu, or click on this link : https://gitlab.com/-/profile/personal_acc

- Click "add new token"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6r0jwhwz9lsd0mtrmtzc.png)

- You have to fill _token name_ , _expiration date_& checked _api_ option
- Click _"create personal access token_ button
- Copy, yor personal access token to some notes (**important** : you only can copy token in first time after token generated, make sure you saved it)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vgbm5j75w9ybzvmxxs4n.png)

## Register Sonarcloud Account

- Open your browser, and visit this link : https://www.sonarsource.com/products/sonarcloud/ 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tnw59pfviy9el9xfo29g.png)

- Click on "Sign Up" button

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/85ti073p78lcaudk2z16.png)

- You can choose account that's you want to integrated, in this tutorial i will using **_gitlab account_** , click on **_gitlab button_**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uwnba3sy0z49dxma515v.png)

- Next, please click on **_authorize_** (Sonarcloud require access to Gitlab repository)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ytn5kp5valj8d257cib9.png)

- If it's your first time using Sonarcloud, you will see this blank page. It's mean nothing project exist in your account

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8k0vn07x26zlhnx0gvu4.png)


Let's continue

## Setup Sonarcloud

- Next, you have to setup sonarcloud, from the blank page, click on button **_analyze new project_** 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7hib77v9upe9n3cof4a3.png)

- Click **_Import a new Organization_**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jp9msn01ndfh1hfid26s.png)

- Next, in this tutorial i want to integrated Sonarcloud with some my personal workspace / project group in Gitlab, so, click in **_Import any Gitlab group_** (if you choose for _import private gitlab_ you have to paid to Sonarcloud / nothing free package)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qbevadv0unuu12m8itjj.png)

- Copy and paste your _personal access token_
- Copy and paste your _group id_ as group key value (you can fund group id on group setting (Group -> select your group -> setting -> general)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hf0e9lzgbbgwhpa4j6rv.png)

- Click "Continue"
- Next, scroll down page, and you have to choose a plan (in this tutorial i will try free version)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aty8p0hwasvoti6rkq23.png)

- Click "create organization"
- Great, your sonarcloud setup is done, next let's back to Gitlab repository

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fle2ilx1n95ew70mwwje.png)


## Create a new project in workspace / group Gitlab (for testing)

- Open your gitlab group, and _create new project_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/huba7uixdm4kw5niixgb.png)

- In this tutorial, i will upload my mini project using Lumen (Laravel Microframework) to gitlab group project *actually you can using another framework, setup process is same.

- Click _create blank project_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hef2ft0h2tgmuscnif44.png)

- Fill the form, and click _create project_ (**_if you want to use free version sonarcloud, please choose "public access" on your project_**)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c27q21z27yruoeu15pxt.png)

## Registered project into Sonarcloud

- Click on _analyze a new project_ button 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/go2rpf5qkcplhpzh65m1.png)

- Sonarcloud will check and listed your public project in workspace

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zerab49unp9jk1o840ed.png)

- Select the project, and click _setup_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/807x788lmvttikwtpcjf.png)

- Choose _previous version_ or _number of days_ (it's based on your preferences, you can change anytime). In this tutorial, i will choose **_previous version_**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/piw6flpajbx7ggcuz399.png)

- Click _create project_
- Choose _With Gilab CI/CD pipeline_ for analysis method

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/90ellr6gij4lab8vxgf6.png)

- You have to add some Sonarcloud credential (token variable and URL) to your Gitlab repository, please follow instructions

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0wt5w1j4nvyubp9gm89x.png)

- Add credential 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ivwzgd878vby7bkynwnl.png)

- Next, you have to add a new file .yml (.gitlab-ci.yml) to your project folder root. Choose your programming languages, make sure it's match (In this tutorial i using Lumen, so i choose PHP version)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/32vcyvefa4plo0luovsn.png) 

```
variables:
  SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"  # Defines the location of the analysis task cache
  GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required by the analysis task
sonarcloud-check:
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  script:
    - sonar-scanner
  only:
    - merge_requests
    - main
    - develop

```

In the last line of code, you have to make sure branch names repository is correct, as default Sonarcloud named main branch as "master", but in gitlab, main branch named as "main", so you have to change "master" to "main"

You can add the branch name when the Sonarcloud will analysis your code.

- In the last step of instructions, you have to create a new file (sonar-project.properties)

```
sonar.projectKey=open-for-public_lumen-restfull-api-with-jwt-authentication
sonar.organization=open-for-public

# This is the name and version displayed in the SonarCloud UI.
#sonar.projectName=Lumen Restfull API With JWT Authentication
#sonar.projectVersion=1.0


# Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
#sonar.sources=.

# Encoding of the source code. Default is default system encoding
#sonar.sourceEncoding=UTF-8
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bjev2gs50vxjflq3j8q0.png)

- You're Done


## Testing 
- Push your code using git command 
- Open **_my project_** menu in Sonarcloud sites

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jd98m169t91rcsfbn4ar.png)

- After push process finish, refresh _my project_ page in Sonarcloud (it'usually takes 1 - 3 minute of analysis process, depend on line of number line of code.)

- If analysis finish, the result will show in page 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ua5un3yoyn0ofypy872t.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5awht5y8wn9en6qa7kof.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2xbzy8907dtc1d4lwqpv.png)

Great, you're done, i hope this article help you. See you on the next post