Unable to get sonar-fortify plugin configured with Jenkins and SonarQube -
i have scoured forums , cannot seem quite understand config fortify plug-in sonar.
i understand builds widget based on data generated .fpr file. setup:
- maven 3 project
- jenkins 1.606
- sonarqube 5.0.1
- sonar-fortify plug-in 2.0
prerequisites:
- .fpr file in jenkins workspace
- sonar added pom.xml
- sonar-fortify-plug-in v2.0 added pom.xml - (wasn’t sure needed or not)
- sonar server configured in jenkins
- sonar fortify plug-in v2.0 added sonar – (only see dropdown ‘enablereportlink’ under ‘configure widgets’ should there more config somewhere?
questions:
- where should property set? jenkins sonar config, sonar, pom file?
sonar-runner -dsonar.fortify.reportpath=/path/to/project.fpr - is path .fpr file within jenkins workspace?
the setup instructions on github seem short , feel missing specific in understanding.
any or direction additional documentation great appreciated.
first of as documented version 2.0 can not used anymore. version 2.1 going released soon. vote release started week. meanwhile can:
- download 2.1-snapshot version , copy in extensions/plugins of sonarqube server installation
- restart server. fortify rules should available in page "rules".
- execute fortify command "sourceanalyzer", independently sonarqube. generates report file suffixed .fpr.
execute standard sonarqube analysis of project adding property sonar.fortify.reportpath, example:
mvn sonar:sonar -dsonar.fortify.reportpath=/path/to/project.fpr
sonar-runner -dsonar.fortify.reportpath=/path/to/project.fpr
if works, can automate these steps in jenkins.
Comments
Post a Comment