Why connect SonarQube

SonarQube is a Code quality source. After you connect, the platform uses your token during repository readiness scans to read live measures and quality gate status per assessed codebase (Governance criterion G4).

The integration is read-only. We never create or change SonarQube projects, quality gates, or analysis settings.

Org-level Sonar rollups in Code Insights update when repositories complete a readiness scan — not on a separate batch polling schedule.

What you need

1. Your SonarQube base URL (for example https://sonarcloud.io or https://sonarqube.example.com).
2. A user or project analysis token with permission to browse projects and read measures.
3. For SonarCloud, your organization key (required for project discovery).
4. Optional default branch fallback when a repo mapping does not specify a branch.

Per-repository project keys are optional: upload a mapping CSV in the integration dialog, edit the preview table, and confirm — or rely on discovery from sonar-project.properties and CI during scans.

Network reachability

Connection test, readiness scans, and Code Insights Sonar rollups call your Sonar from the AI Driven SDLC cloud, not from your browser. A VPN on your laptop only helps you reach Sonar locally; it does not route platform traffic.

Choose the pattern that matches how your organization hosts Sonar:

1. Prefer SonarCloud when possible

SonarCloud is hosted on the public internet. Connect with base URL https://sonarcloud.io, your organization key, and an API token. No corporate VPN or inbound firewall rules are required for the platform to reach Sonar.

2. Self-hosted SonarQube on a reachable HTTPS URL

If you run SonarQube Server in your own data center or cloud:

• Register a public HTTPS base URL (for example https://sonar.example.com) that terminates TLS at a reverse proxy or load balancer in your DMZ.
• Grant the token read-only access to browse projects and read measures and quality gates.
• Restrict access at the firewall if needed: allow outbound-initiated HTTPS from the AI Driven SDLC platform to that URL. Contact your account team or support for current egress IP ranges to allowlist.
• Do not use localhost, RFC1918 addresses (10.x, 172.16–31.x, 192.168.x), or internal DNS names that only resolve on the corporate network.

Test connection in the integration dialog is a good check: if it fails from the platform, readiness scans cannot collect live G4 evidence either.

3. SonarQube only on a private network

If Sonar is only reachable over VPN or inside a VPC with no public or tunneled path, the platform cannot run live probes today. Options your infrastructure team may use:

• Outbound tunnel (for example Cloudflare Tunnel or similar): a small agent in your network exposes Sonar to a controlled public hostname without opening inbound ports.
• DMZ reverse proxy that forwards to internal Sonar (same as section 2, with stricter network segmentation).

Without one of these, you may still connect GitHub and run readiness scans, but G4 will reflect CI and repository hints only (partial evidence), not live quality-gate status from Sonar.

Setup

1. In SonarQube or SonarCloud, open My Account → Security and generate a token.
2. In the platform, go to Settings → Integrations, open Security & Identity, add SonarQube, then choose Connect.
3. Enter base URL, API token, and organization (SonarCloud only). Optionally set a workspace default branch fallback.
4. Click Test connection, then Connect to store encrypted credentials.
5. (Recommended for multi-repo workspaces) Upload a repo → project key mapping CSV, fix any rows in the preview, and click Confirm mappings.

Mapping file format

CSV columns: provider_slug, project_key, optional branch. Use the repository slug shown in the platform catalog (owner/repo). A template is available from the integration dialog.

Data we read

SonarQube data	Platform use
Token validation on connect	Confirms credentials
Per-repo measures and quality gate during readiness scans	G4 evidence and Code Insights Sonar rollup
Optional mapping validation	Probes project keys before save

Data we do not read or change

Not accessed	Notes
Source code	Not exported
Quality gate or analysis settings	Read-only
Webhooks or CI integration	Not configured by the platform

Disconnect

Remove SonarQube under Integrations → Disconnect. Repo mappings are removed with the workspace integration data model when you replace mappings or disconnect per your workspace admin workflow.