{
  "slug": "Add-SonarQube-to-the-Golang-project-28da80b3ee95",
  "title": "Add SonarQube to the Golang project",
  "subtitle": "In modern software development, maintaining high code quality, identifying security vulnerabilities, and ensuring efficient code practices…",
  "excerpt": "In modern software development, maintaining high code quality, identifying security vulnerabilities, and ensuring efficient code practices…",
  "date": "2025-09-12",
  "tags": [
    "Go",
    "Security"
  ],
  "readingTime": "3 min",
  "url": "https://medium.com/@mobinshaterian/add-sonarqube-to-the-golang-project-28da80b3ee95",
  "hero": "https://cdn-images-1.medium.com/max/800/1*d2KJKWri0ya81Hr1Z28UfQ.jpeg",
  "content": [
    {
      "type": "heading",
      "level": 2,
      "text": "Add SonarQube to the Golang project"
    },
    {
      "type": "paragraph",
      "html": "In modern software development, maintaining high code quality, identifying security vulnerabilities, and ensuring efficient code practices are critical for building robust and scalable applications. SonarQube, a leading open-source platform for continuous code quality inspection, plays a pivotal role in addressing these needs by analyzing code for bugs, code smells, security hotspots, and other issues across multiple languages — including Go (Golang)."
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*d2KJKWri0ya81Hr1Z28UfQ.jpeg",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 1120,
      "height": 1120
    },
    {
      "type": "paragraph",
      "html": "This article provides a practical, step-by-step guide to integrating SonarQube into a Golang project. Whether you’re a developer looking to enhance your code’s maintainability or a team aiming to enforce consistent quality standards, this tutorial will walk you through the essential processes: installing Docker (for running the SonarQube server), setting up prerequisites like Java and the SonarScanner CLI, configuring your project for SonarQube analysis, generating necessary coverage and test reports, and executing the SonarScanner to submit your project’s code quality data to the SonarQube server."
    },
    {
      "type": "paragraph",
      "html": "By following these steps, you’ll gain visibility into your Go code’s health, enabling proactive fixes and fostering better collaboration. Let’s dive into the process to ensure your Golang project benefits from SonarQube’s powerful code inspection capabilities."
    },
    {
      "type": "paragraph",
      "html": "Once a clean architecture has been developed using GoLang, integrating SonarQube becomes necessary to enhance the analysis of test coverage and code quality."
    },
    {
      "type": "heading",
      "level": 2,
      "text": "✅ Step 1: Install Docker"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "✅ Step 2: Prerequisites"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "1. Run a SonarQube Server (Optional for Local Testing)"
    },
    {
      "type": "paragraph",
      "html": "Download and install the <a href=\"https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/?spm=a2ty_o01.29997173.0.0.67f4c92170JDbZ\" target=\"_blank\" rel=\"noreferrer noopener\">SonarScanner CLI&nbsp;</a>:"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "docker run --name sonarqube \\\n  -p 9000:9000 \\\n  sonarqube:latest"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "Then access:\nhttp://localhost:9000Default login: admin / admin"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "2.SonarScanner CLI"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Install Java (SonarScanner requires Java)"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "# Update package list\nsudo apt update# Install OpenJDK 17 (recommended)\nsudo apt install\nopenjdk-17-jdk -y# Verify Java installationjava -version"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Download SonarScanner"
    },
    {
      "type": "code",
      "lang": "go",
      "code": "# Download SonarScanner (replace with latest version if needed)wget\nhttps://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006-linux.zip# Create a directory for SonarScannersudo mkdir -p /opt/sonar-scanner# Unzip the downloaded filesudo unzip sonar-scanner-cli-5.0.1.3006-linux.zip -d /opt/sonar-scanner# Rename folder for easier referencesudo mv /opt/sonar-scanner/sonar-scanner-5.0.1.3006-linux /opt/sonar-scanner/sonar-scanner"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Set Environment Variables"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "echo 'export SONAR_SCANNER_HOME=/opt/sonar-scanner/sonar-scanner' | sudo tee -a /etc/profileecho\n'export PATH=$SONAR_SCANNER_HOME/bin:$PATH' | sudo tee -a /etc/profile"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Reload the environment:"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "source /etc/profile"
    },
    {
      "type": "paragraph",
      "html": "💡 Alternatively, add those lines to <code>~/.bashrc</code> if you want it only for your user:"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "cho 'export SONAR_SCANNER_HOME=/opt/sonar-scanner/sonar-scanner' >> ~/.bashrcecho\n'export PATH=$SONAR_SCANNER_HOME/bin:$PATH' >> ~/.bashrcsource ~/.bashrc"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Verify Installation"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "sonar-scanner -v"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "✅ Step 3: Add SonarQube Configuration to Your Project"
    },
    {
      "type": "code",
      "lang": "go",
      "code": "# Required metadatasonar.projectKey=mobintmu_go-simplesonar.projectName=Go\nSimplesonar.projectVersion=1.0# Source code locationsonar.sources=.# Languagesonar.language=go#\nEncodingsonar.sourceEncoding=UTF-8# Exclude tests and vendor\n(optional)sonar.exclusions=**/vendor/**,**/*_test.go# Go-specific: Use golangci-lint to generate\nreport for\nSonarQubesonar.go.coverage.reportPaths=coverage.outsonar.go.tests.reportPaths=test-report.xml"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "✅ Step 4: Generate LCOV Report for SonarQube (2024+ Compatible), Run Go Tests & Generate Coverage Profile"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "go test -coverprofile=coverage.out ./..."
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "go test ./... -json > report.json"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "✅ Step 5: Run SonarScanner"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "sonar-scanner \\  -Dsonar.projectKey=my-go-project \\  -Dsonar.sources=. \\\n-Dsonar.go.coverage.reportPaths=coverage.out \\  -Dsonar.host.url=http://localhost:9000 \\\n-Dsonar.login=<your_token>"
    },
    {
      "type": "code",
      "lang": "go",
      "code": "INFO: Start fetching files for the text and secrets analysisINFO: Using Git CLI to retrieve\nuntracked filesINFO: Retrieving language associated files and files included via\n\"sonar.text.inclusions\" that are tracked by gitINFO: Starting the text and secrets analysisINFO: 9\nsource files to be analyzed for the text and secrets analysisINFO: 9/9 source files have been\nanalyzed for the text and secrets analysisINFO: 2 files are ignored because they are untracked by\ngitINFO: Sensor TextAndSecretsSensor [text] (done) | time=281msINFO: ------------- Run sensors on\nprojectINFO: Sensor Zero Coverage SensorINFO: Sensor Zero Coverage Sensor (done) | time=0msINFO:\n------------- Gather SCA dependencies on projectINFO: Dependency analysis skippedINFO: CPD Executor\nCalculating CPD for 5 filesINFO: CPD Executor CPD calculation finished (done) | time=4msINFO:\nAnalysis report generated in 38ms, dir size=261.2 kBINFO: Analysis report compressed in 12ms, zip\nsize=39.6 kBINFO: Analysis report uploaded in 13msINFO: ANALYSIS SUCCESSFUL, you can find the\nresults at: http://127.0.0.1:9000/dashboard?id=go-simpleINFO: Note that you will be able to access\nthe updated dashboard once the server has processed the submitted analysis reportINFO: More about\nthe report processing at http://127.0.0.1:9000/api/ce/task?id=696eINFO: Analysis total time: 1.950\nsINFO: ------------------------------------------------------------------------INFO: EXECUTION\nSUCCESSINFO: ------------------------------------------------------------------------INFO: Total\ntime: 2.619sINFO: Final Memory: 17M/80MINFO:\n------------------------------------------------------------------------"
    },
    {
      "type": "embed",
      "provider": "youtube",
      "url": "https://www.youtube.com/embed/2IWQW2prcBI?feature=oembed"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Gitginore"
    },
    {
      "type": "paragraph",
      "html": "Add these files to&nbsp;.gitignore"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "sonar_command.txt.scannerwork/report.jsoncoverage.out"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Result"
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*tVfeQJSVSLdqg5GQh0U8_A.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 1046,
      "height": 629
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*l8Sz1nMzawWLfrIJpZT3Xg.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 1475,
      "height": 446
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Summarize commands:"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "docker run --name sonarqube \\\n  -p 9000:9000 \\\n  sonarqube:latest\ngo test -coverprofile=coverage.out ./...\ngo test ./... -json > report.json```sonar-scanner \\\n  -Dsonar.projectKey=go-simple \\\n  -Dsonar.sources=. \\\n  -Dsonar.host.url=http://127.0.0.1:9000 \\\n  -Dsonar.token=sqp_XXXXXXX```export SONAR_HOST_URL=http://127.0.0.1:9000export SONAR_TOKEN=sqp_XXXXXX"
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*-L41hUvn52jcQnIPgNcCmg.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 1037,
      "height": 401
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Github Commit codes"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Set up Sonar Local Project"
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*REbZluxFQfmKbcNbjVB7FA.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 1484,
      "height": 504
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*nV52P9JmweC88bYW_8ixkg.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 414,
      "height": 417
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*H0y7XZQEq3qmCR4FiNwFpg.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 670,
      "height": 351
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*UjJphd3SNjsIYuQTPtIRoQ.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 902,
      "height": 607
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*Sq5FB7ZHQZFq5VCkcyca6Q.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 281,
      "height": 340
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*vof14nkeuCqxAYWYKqwyPA.png",
      "alt": "Add SonarQube to the Golang project",
      "caption": "",
      "width": 1067,
      "height": 360
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Final Docker-Compose file"
    },
    {
      "type": "code",
      "lang": "yaml",
      "code": "services:\n  redis:\n    image: redis:alpine\n    ports:\n      - \"6379:6379\"\n    volumes:\n      - redis-data:/data\n    restart: unless-stopped\n  postgres:\n    image: postgres:latest\n    environment:\n      - POSTGRES_USER=user\n      - POSTGRES_PASSWORD=pass\n      - POSTGRES_DB=database\n    volumes:\n      - postgres-data:/var/lib/postgresql/data\n    ports:\n      - \"5432:5432\"\n    restart: unless-stopped\n  sonar:\n    image: sonarqube:latest\n      ports:\n      - \"9000:9000\"\n    volumes:\n      - sonar-data:/opt/sonarqube/data\n      - sonar-extensions:/opt/sonarqube/extensions\n      - sonar-logs:/opt/sonarqube/logs\n    restart: unless-stopped\n    deploy:\n      resources:\n        limits:\n          memory: 2g\n        reservations:\n          memory: 2gvolumes:\n  redis-data:\n  postgres-data:\n  sonar-data:\n  sonar-logs:\n  sonar-extensions:"
    }
  ]
}