SonarQube Pull Requests in Bitbucket Cloud
Tags: sonarqube, bitbucket, devops
Published: 2019-10-27 21:52:01

---
title: SonarQube Pull Requests in Bitbucket Cloud
published: true
description: A story of a Code Monkey trying out static analysis tools and integrating them with Bitbucket
tags: sonarqube,bitbucket,devops
cover_image: https://thepracticaldev.s3.amazonaws.com/i/lzd4xiloygwnxvrwrs9g.png
---
# Please note :heart:
I created the solution I did and wrote what I wrote because there was a problem I was trying to solve within a set of requirements / "boundaries" lets say.

Using this solution requires the usage of SonarQube "analysis mode", which is [deprecated since SonarQube 6.6](https://docs.sonarqube.org/7.4/analysis/analysis-parameters/). Once this solution is implemented you can't easily upgrade, without breaking the pull request analysis.

Please use this solution at your own discretion :fire:

--------

I'll start by saying, the solution was way easier than I originally anticipated... I thought I was gonna have to run a Docker container with a microservice of some kind written in Java, Node.JS or Golang and run Sonar Scanner when a pull request was created or updated based on a webhook from Bitbucket.

But... As always, eventually the solution was so much easier, but what's the fun in writing a blog when you don't write about the way you failed miserably before succeeding?

**Where it all started, a long... long time ago**
From the very moment I met her, SonarQube, I knew I was in love. Knowing that it had a tiny, little, cute container that you could easily run with a single keystroke in the command line, with an embedded H2 database for convenience, and even an embedded instance of Elasticsearch, I couldn't be more intrigued :heart_eyes:

I looked into some different static analysis tools, such as [Code Climate](https://www.codeclimate.com/), [SonarCloud](https://www.sonarcloud.io) and [Exakat](https://www.exakat.io), but they were either priced based on the size of your organization (Code Climate), or your projects (pricing based on LOC for SonarCloud), which might've caused scaling issues in the future. Or they weren't as easy to integrate with the existing tools such as Bitbucket Cloud, or didn't really have a friendly UI for the developer using it in case of Exakat.

**Integrating SonarQube with Bitbucket Cloud** :cloud:
[Mibex Software](https://www.github.com/mibexsoftware) has a wonderful SonarQube plugin, [Sonar Bitbucket Cloud Plugin](https://github.com/mibexsoftware/sonar-bitbucket-plugin), which analyzes and comments on your pull requests.

I decided to give it a go, I cloned the repository, built it with Maven so that I had a beatiful JAR to rsync to my Droplet on DigitalOcean and installed it to my SonarQube instance.

I installed the [Sonar for Bitbucket Cloud](https://marketplace.atlassian.com/apps/1214134/sonar-for-bitbucket-cloud?hosting=cloud&tab=overview) plugin through the Bitbucket Marketplace, and expected that it'd have a built-in webhook to inform the SonarQube plugin whenever a pull request was created or updated, ran the analysis and comment on the pull request with its findings.

But, it wasn't that easy. It turns out, that if I had read the documentation fully, from top to bottom, it documents the fact that I had to run Sonar using Maven, or as I later found out the Sonar Scanner, to trigger an analysis on SonarQube.

**It was fun for the time being, but... We'll stay friends!** :heart:
[Sonar for Bitbucket Cloud](https://marketplace.atlassian.com/apps/1214134/sonar-for-bitbucket-cloud?hosting=cloud&tab=overview) seemed to really only add the statistics on the overview page of your Bitbucket repository, it didn't really seem to contribute to commenting with found issues on your pull requests.

![Sonar for Bitbucket Cloud Statistics on Repository Overview](https://thepracticaldev.s3.amazonaws.com/i/9dn1om8a970orxdwjlt7.png)

**So... Before running it in automation, lets try it manually?** :wrench::hammer:
It turns out that the Sonar Bitbucket Cloud plugin that I installed on my SonarQube installation also works when I simply run the Sonar Scanner with a few more arguments than I'd normally pass to it.

I hear you thinking, "uhm... but... wasn't that so obvious?!", and I know that now. But in the moment itself I wanted to pull the hairs, that I still have at this age, out of my head because of the frustration. 

Originally I read [this article (Decorate Bitbucket Cloud Pull Request with SonarQube Server Comments)] (https://medium.com/@farooqahmadkhan/decorate-bitbucket-pull-request-with-sonar-qube-comments-81eb6c22f071) to get familiar, so I got confused by the fact that the author was using a Maven goal to run the scanner.

When I ran the Sonar Scanner manually the pull request was analyzed and the Sonar Bitbucket Cloud plugin successfully commented on it with the issues that were found, in this case none.

```
sonar-scanner -Dsonar.projectBaseDir=$(pwd)
    -Dproject.settings=sonar.properties
    -Dsonar.analysis.mode=issues
    -Dsonar.bitbucket.repoSlug=<repoSlug>
    -Dsonar.bitbucket.accountName=<accountName>
    -Dsonar.bitbucket.branchName=<branch>
    -Dsonar.bitbucket.oauthClientKey=<oauth-client-key>
    -Dsonar.bitbucket.oauthClientSecret=<oauth-client-secret>
    -Dsonar.login=<sonar-token>
    -Dsonar.bitbucket.pullRequestId=<pull-request-id>
```

![Bitbucket Pull Request Comments](https://thepracticaldev.s3.amazonaws.com/i/eiu26fjxqevy09m835jc.png)

**Should we integrate this with our CI/CD? Of course!** :rose:
When I knew that the Sonar Scanner worked, I wanted to integrate it with our CI/CD to automate the analysis of both our integration branch as well as pull requests.

In the article I mentioned earlier, our beloved Jenkins was mentioned as well as some kind of microservice written in Java that was meant to trigger an analysis on SonarQube whenever a pull request was created or updated, based on a Bitbucket webhook.

So... I tried writing a microservice myself using Node.JS and Express.js to trigger an analysis based on a pull request creation or update event, but I quickly found out that Bitbucket has support for so called ["Pull Request Pipelines"](https://bitbucket.org/blog/faster-feedback-on-merges-with-pull-request-pipelines).

*I don't like over-engineering, but... It's my first instinct sometimes, and I fear that it's a curse...* :skull::eyes:

**Using the blessing which are "Pull Request Pipelines"** :see_no_evil::cupid:
When I figured out how the pull request pipelines worked, I was (still am) in love. What I ended up with was the pipeline configuration below :heart_eyes:

```yaml
pipelines:
  pull-requests:
    '**':
      - step:
          name: SonarQube Analysis
          image: newtmitch/sonar-scanner:4.0.0-alpine
          script:
            - sonar-scanner -Dsonar.projectBaseDir=$(pwd) 
              -Dproject.settings=sonar.properties
              -Dsonar.analysis.mode=issues
              -Dsonar.bitbucket.repoSlug=$BITBUCKET_REPO_SLUG 
              -Dsonar.bitbucket.accountName=$BITBUCKET_REPO_OWNER 
              -Dsonar.bitbucket.branchName=$BITBUCKET_BRANCH 
              -Dsonar.bitbucket.oauthClientKey=$OAUTH_CLIENT_KEY 
              -Dsonar.bitbucket.oauthClientSecret=$OAUTH_CLIENT_SECRET 
              -Dsonar.login=$SONAR_LOGIN 
              -Dsonar.bitbucket.pullRequestId=$BITBUCKET_PR_ID
  branches:
    master:
      - step:
          name: SonarQube Analysis
          image: newtmitch/sonar-scanner:4.0.0-alpine
          script:
            - sonar-scanner -Dsonar.projectBaseDir=$(pwd)
              -Dproject.settings=sonar.properties
              -Dsonar.login=$SONAR_LOGIN
```

Bitbucket has a bunch of [pre-defined environment variables](https://confluence.atlassian.com/bitbucket/variables-in-pipelines-794502608.html#Variablesinpipelines-Defaultvariables) that you can use in these kind of situations. Environment variables that you need to define yourself are:

- `SONAR_LOGIN` which is a [SonarQube User Token](https://docs.sonarqube.org/latest/user-guide/user-token/)
- `OAUTH_CLIENT_KEY` and `OAUTH_CLIENT_SECRET`require an [OAuth consumer](https://developer.atlassian.com/cloud/bitbucket/modules/oauth-consumer/) to be configured with read access to the account and write access to pull requests.

![Bitbucket OAuth Consumer Permissions](https://thepracticaldev.s3.amazonaws.com/i/d9a2wz0lamy1w8yvw6w2.png)

For some reason a "Callback URL" is required, otherwise you can't create the OAuth consumer.

![Bitbucket OAuth Consumer Callback URL](https://thepracticaldev.s3.amazonaws.com/i/i9zoqsn02o9mv4l1eqo2.png)

**Telling SonarQube what project the repository is for!** :page_with_curl::pushpin:
As you might have noticed within the command that I use to run the Sonar Scanner, it has an argument.

`Dproject.settings=sonar.properties` is the argument I'm talking about. It tells the scanner where to find the properties for this specific project, in this case it's the `sonar.properties` file at the root of the repository.

```
sonar.host.url=https://sonarqube.dev
sonar.projectKey=sonarqube-experimentation
sonar.projectName=SonarQube Experimentation
```

**What are my next steps going to be in this journey?** :monkey:
What I noticed while I was researching, trying stuff out and miserably failing is that I had many individual resources but no way to consistently reproduce them.

What would happen if something went wrong. I corrupt one of my DigitalOcean droplets that was running Docker with SonarQube for example? I couldn't easily spin up another and be certain that it would be exactly the same, I didn't really document the steps I took through the way of research 

Because of this I decided to become more familiar with the idea of *"Infrastructure as Code"*, or shortened by the acronym *"IaC"*!

**Terraform kinda fell into my lap at this point** :eyes::100:

[Terraform](https://www.terraform.io) is one of the tools in the HashiStack by [HashiCorp](https://www.hashicorp.com). It enables you to write your infrastructure in a declarative configuration, thus "Infrastructure as Code".

I plan to write a different blog about it where I'll reflect onto the stuff I learned, mistakes I made and times I fell face-first into seaming unsolvable problems!

![](https://media1.tenor.com/images/5850e3f3ea819e382f80fa6750cf381f/tenor.gif?itemid=4902263)

As always, I hope you learned something from my failures (:poop:), and if not, I'm praying that you at least had fun reading about them :fire: