Setting Up SonarQube for Python Application

Setting Up SonarQube for Python Project

This article aims to outline the basics of SonarQube and also learn setting up SonarQube for Python application.

What is Static Testing ?

A debugging method that examines source code before the program is run, that is testing the code without executing it. It does this by analysing the code against a pre-set of coding rules and ensures that it conforms to the guidelines.

What is SonarQube ?

It is an open source platform that helps manage the code quality by performing static code analysis. It supports multiple languages and integrates well with CI/CD pipelines, ensuring that code is above threshold before its deployment. In simple words it is a central hub where analysed code is stored, visualised and reported. SonarQube provides insights about

• Code Smells- Non-critical issues that indicate maintainability concerns
• Bugs- Code fragment that could lead to erroneous behaviour
• Vulnerabilities- Security flaws that might expose application to attacks
• Coverage- Percentage of code covered by tests
• Duplications- Fragment of code that are repeated

Each finding is scored by severity from critical to minor issues.

What is a Sonar Scanner ?

It is a command-line tool that analyzes source code and sends the results to SonarQube. It acts as a bridge between the codebase and the SonarQube. Sonar scanner extracts source code metrics, violations and other information and then prepares data for visualisation and management in SonarQube. It is configured via simple properties files.

Sonar Scanner

Getting Started

We will create a simple project by building a Notification service that exposes API to send emails to customers and also integrate SonarQube with the service.

1. Setup- Installations and Downloads

• Download the SonarQube, Sonar Scanner
• Download the couchbase server community version. Post download, create a new cluster with a new bucket and user. Give bucket name and username of your choice and use the same names (bucketname , username and password) in .env file
• Login / Signup on Mailjet website and generate the API key and API secret . Replace the values in the .env file of notification gateway service
• Install couchbase, load_dotenv, flask, flask-restx, mailjet_rest packages

2. Project Structure

Project Structure

3. Code

• .env

.env

• cb.py

cb.py

• app.py

app.py

4. Configuring SonarQube

• Once the downloaded sonarqube folder(Java 17 is a prerequisite) is extracted, Navigate and go to the bin directory to start the sonarqube service. Execute the below command in the terminal and open the browser and navigate to http://localhost:9000.

./sonar.sh start

Starting the SonarQube

localhost:9000

• By Default the Login and password will be admin. In the SonarQube dashboard click on create Project, select Local Import and enter the Project Display Name and Project Key. Then Click on Next.

Creating Project

• Later select the Use the global setting option and click on Create Project.

Option selection

5. Configuring Sonar Scanner

• Once the downloaded sonar scanner folder is extracted, Navigate and go to the conf/sonar-scanner.properties file and add the below lines and save it

sonar-scanner.properties

• Open a new terminal , navigate to the bin folder and execute the below command

./sonar-scanner -Dsonar.projectKey=<YOUR_PROJECT_KEY> -Dsonar.projectBaseDir=<PATH_OF_PYTHON_PROJECT>

Running Sonar Scanner

Successful Analysis

6. Understanding SonarQube Report

Once the analysis is completed , the SonarQube’s dashboard will provide the detailed insights .

Dashboard Insights

Insights with the issue count and criticality rating against it

Duplication Issue

Maintainability Issue

Security Issue

The reported issues can be fixed using the suggestions from SonarQube . Post fixing the issues rerun the sonar scanner to generate the new report (analysis).

Conclusion

In this story, we have seen the basics of SonarQube and also learnt how to integrate SonarQube with a Python application in simple steps. SonarQube effectively can boost team’s productivity, improve application performance, and reduce long-term technical debt, ultimately leading to higher-quality Python projects.Hope everything is clear !

Get Ashish MJ’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Github Website Linkedin

Additional Resource

• Flask
• Rest API’s

Thank you for being a part of the community

Before you go:

• Be sure to clap and follow the writer ️👏️️
• Follow us: X | LinkedIn | YouTube | Newsletter | Podcast
• Check out CoFeed, the smart way to stay up-to-date with the latest in tech 🧪
• Start your own free AI-powered blog on Differ 🚀
• Join our content creators community on Discord 🧑🏻‍💻
• For more content, visit plainenglish.io + stackademic.com