Announcement: SonarQube integration rolling out

[#1]

Hey everyone, I'm excited to share a new integration with SonarQube that brings in a new metric for Quality Gates! To setup SonarQube with Compass, click "Create", then "Incoming webhooks", click "Create", and choose "SonarQube" from the dropdown.

Following the setup steps in Compass you'll get a URL and some instructions on how to set up a webhook in SonarQube. You'll then need to setup the webhook for each SonarQube Project or Portfolio, and finally add a link to a SonarQube Project to the Dashboards link section for a Compass component. 

This integration is still rolling out to all customers so if you don't see it just yet check back end of the week.

Happy Holidays!

[Pete Stanley]

Great stuff! Have tested this out and works pretty nicely. Awesome to have self-hosted support as first-class citizen.

Is this the only metric we should expect to see available after integration?

It would be nice to have some pattern matching controls for automatic project > component linking.

• It's challenging currently as most of our SQ projects were imported via the SCM (Github) SQ integration which applies a "<org>_" prefix and "_<GUID>" suffix to each project key. As it's pretty unsightly we're unlikely to change component names in Compass to match.
• Wherever possible, would suggest automatic project matching is a key capability that goes a long way towards surfacing the metric and mass adoption of the feature. That being said, dropping a dashboard link works well, would just help to reduce training if automatic linking had slightly more admin controls.

Would love to see some native support for either Prisma Cloud or Checkov next.

[Josh Campbell]

Thanks a ton for the feedback Pete! This is the only metric currently. Especially great note on the SonarQube GitHub import prefixing the org name. I misspoke in my original post about automatic mapping, looks like that is still in the works so this was very helpful. 

[Josh Campbell]

Hey Pete, I was trying to find this in the SQ docs but for the GitHub import, is the GUID random and not the name of the repo? Would you be able to share an example? Thanks!