How to make Pull Request trigger Sonarqube scan

[enduser6]

Hello,

 New to BitBucket... inherited a project, now trying to get up to speed and code-complete ASAP. We have a DevSecOps pipeline using BitBucket as SCM, SonarQube as our static analysis engine. Java is the development language. My Tech Lead would like to prevent a Merge of a Pull request if there are Critical or High issues found in the SonarQube analysis of code in the Pull request. So, I am looking for a way to trigger SonarQube scan on a Pull request and if it fails (Critical issue found) the Merge is not allowed to go through or some notification is sent. There is hope also that issue that pre-existed on the branch would not trigger the notification (legacy issues don't break Merge requests); 

I see plugins for BitBucket that are "pull-request decorators" but they lack documentation (open source ones do, anyway...); any assistance is appreciated. 

[Aron Gombas _Midori_ · Accepted solution]

Check out this Bitbucket add-on: https://marketplace.atlassian.com/plugins/ch.mibex.stash.sonar4stash/server/overview

[enduser6]

thanks, Aron. That seems to be the most often recommended plugin to accomplish this. I will pursue it as a solution. 

[Aron Gombas _Midori_]

Glad that it was helpful. Please remember to click the checkmark at the answer so that future viewers see that as the "correct" answer.

[Jose Ramon Mañes]

Hi guys, how´s going on?

I´m having the same needed but in my case I have a SonarQube server and I´m using BB Cloud, do you know if there is any similar plugin or something similar to get the results when someone does a pull request?

Regards,

Jose Ramon Mañes

[amathur11]

I am also having the same scenario but we dont have bitbucket server, so can we still integrate bitbucket with sonarqube

[Aron Gombas _Midori_]

Update: we have recently released a new app called Better DevOps Automation. It allows executing automations with Git, Subversion, Bitbucket, GitLab, GitHub and other Version Control System implementations.

The automations can be started by multiple types of triggers. The automations can do a bazillion of different things, also including SonarQube and other type of code quality checks.

You may find something useful here, make sure you check this out.