A SonarQube plugin to analyze Clojure source.
- Static code analysis powered by eastwood and kibit.
- Detection of outdated dependencies/plugins powered by lein-ancient.
- Coverage reports powered by cloverage.
- Detection of vulnerable dependencies powered by lein-nvd.
This plugin was inspired in the previous SonarClojure that at this moment is not under development and doesn't support SonarQube 6.7. Since the changes to port the old plugin were very extensive, I decided to start from scratch and use the old plugin as inspiration.
In order to install SonarClojure:
- Download the latest jar of the plugin.
- Place the jar in the SonarQube server plugins directory, usually located under:
- Restart the SonarQube server.
Change your project.clj file and add the required plugins:
:plugins [[jonase/eastwood "0.2.5"] [jonase/kibit "0.1.6"] [lein-ancient "0.6.15"] [lein-cloverage "1.0.13"] [lein-nvd "0.6.0"]]
Create a sonar-project.properties file in the root folder of your app:
sonar.projectKey=your-project-key sonar.projectName=YourProjectName sonar.projectVersion=1.0 sonar.sources=src,project.clj sonar.clojure.lein-nvd.json-output-location=target/nvd/dependency-check-report.json sonar.clojure.cloverage.json-output-location=target/coverage/codecov.json
Run sonar-scanner on your project.
Sensors can be disabled by setting
by using command line switch
-Dsonar.clojure.<sensorname>.disabled when running sonar-scanner.
Sensor names are
Some sensors have mandatory properties. Keep in mind that if you don't disable it, you will have to set the property.
Building from Source
./mvnw clean package
Maven will generate a SNAPSHOT under the folder target.
At the moment, SonarClojure was tested on SonarQube up to version 7.1.
We noticed that in later versions of SonarQube, the project overview might be empty. This normally suggests that SonarClojure was not able to detect analyzable files during the scanning.
SonarClojure is open-sourced software licensed under the MIT license.