Unable to get sonar-fortify plugin configured with Jenkins and SonarQube -


i have scoured forums , cannot seem quite understand config fortify plug-in sonar.

i understand builds widget based on data generated .fpr file. setup:

  • maven 3 project
  • jenkins 1.606
  • sonarqube 5.0.1
  • sonar-fortify plug-in 2.0

prerequisites:

  • .fpr file in jenkins workspace
  • sonar added pom.xml
  • sonar-fortify-plug-in v2.0 added pom.xml - (wasn’t sure needed or not)
  • sonar server configured in jenkins
  • sonar fortify plug-in v2.0 added sonar – (only see dropdown ‘enablereportlink’ under ‘configure widgets’ should there more config somewhere?

questions:

  • where should property set? jenkins sonar config, sonar, pom file?
    sonar-runner -dsonar.fortify.reportpath=/path/to/project.fpr
  • is path .fpr file within jenkins workspace?

the setup instructions on github seem short , feel missing specific in understanding.

any or direction additional documentation great appreciated.

first of as documented version 2.0 can not used anymore. version 2.1 going released soon. vote release started week. meanwhile can:

  • download 2.1-snapshot version , copy in extensions/plugins of sonarqube server installation
  • restart server. fortify rules should available in page "rules".
  • execute fortify command "sourceanalyzer", independently sonarqube. generates report file suffixed .fpr.
  • execute standard sonarqube analysis of project adding property sonar.fortify.reportpath, example:

    mvn sonar:sonar -dsonar.fortify.reportpath=/path/to/project.fpr

    sonar-runner -dsonar.fortify.reportpath=/path/to/project.fpr

if works, can automate these steps in jenkins.


Comments

Popular posts from this blog

cakephp - simple blog with croogo -

How to group boxplot outliers in gnuplot -

bash - Performing variable substitution in a string -