How to configure GitLab and SonarQube


Developer is working on source code using GitLab as version control system and GitLab CI/CD for automating development pipeline. By integrating SonarQube, an open-source platform for continuous code quality inspection, we can add an extra layer of code analysis to CI pipeline. Integrating SonarQube with GitLab CI enables us to perform static code analysis on source code. SonarQube scans the code for potential bugs, code smells, and vulnerabilities. It provides detailed reports highlighting areas that require attention, such as complex code, potential security vulnerabilities, or violations of coding best practices. SonarQube analyzes the code changes made in each commit and provides feedback on code quality and potential issues. This ensures that our code adheres to industry standards and maintains high quality. Integrating SonarQube with GitLab CI empowers teams to automate code quality checks seamlessly as part of the CI pipeline.


We will configure two servers with Ubuntu 20.04 operating system. The first server will be dedicated for configuration of SonarQube. The second server will be used for configuring self hosted GitLab Runner. Self-hosted runners allow us to run CI/CD pipelines in environments that are isolated from the internet or have restricted network access. Using self-hosted runners can be more cost-effective compared to using shared runners provided by GitLab. With a self-hosted runner, we have full control over the infrastructure where the code is executed and allows us to ensure the security and compliance requirements.

1*kzMhQRmej qMdkKcscQRyw
Code Quality Analysis Automation with SonarQube and GitLab CI Pipeline


GitLab Runner


SonarQube 10.1


SonarQube Configuration

Refer this blog for SonarQube configuration:

GitLab Runner Configuration

Install Docker on the server because we will use docker as executor.

Now run the following commands to configure GitLab Runner :

sudo curl -L --output /usr/local/bin/gitlab-runner \
sudo chmod +x /usr/local/bin/gitlab-runner
sudo useradd --comment 'GitLab Runner' \
--create-home gitlab-runner --shell /bin/bash
sudo gitlab-runner install --user=gitlab-runner \
sudo gitlab-runner start

Now Login to GitLab account and create a new project.

1*fYt6TdcSf3CCXLUC j4D1w

In Settings, click on CI/CD and click on Expand in Runners.


Disable the shared runners because we are going to use self-hosted runners instead of shared runners, then click on New Project Runner.


Select Linux as Operating system and give a tag (sonarqube) which will be used in our pipeline to select this runner.

1*D0Lu488nXs20 WVX7oGXIg

Now copy the command provided in the next step and run on GitLab runner server.

gitlab-runner register --url https://gitlab.com --token $TOKEN

Select docker as executor and enter docker as image name in the prompt of this command.

After successfully registering the runner, Run the following command.

gitlab-runner run

We can see the registered runner in the GitLab interface.

1*U2Ees KQLm63zRsseunMNg

Now create a personal access token in GitLab for authenticating SonarQube with GitLab.


Project Creation in SonarQube:

In SonarQube, go to Administration => Configuration => ALM Integration => GitLab

Click on Create Configuration.


Give any Configuration name (gitlab), enter https://gitlab.com/api/v4 as GitLab API URL, and enter the Personal Access token generated in GitLab.


After saving the configuration, we can see configuration is valid.

1*RQab0s54kW pbKcz1vn Wg

Now add a project in SonarQube and select From GitLab.


In the next step enter personal access token generated in GitLab.

1*6ZJ6nsgL s5ALA3HfnN2DA

In the next step we can see the project of our GitLab and click on Set up .


In the next step select With GitLab CI.

In the next step we can select the language or the framework with respect to our source code.

Create a file name sonar-project.properties in GitLab Project and save the code provided in the next step in SonarQube.


Now in next step, click on Generate a token. Add variable in GitLab named SONAR_TOKEN and give the token generated as values. Uncheck the “Protect variable” checkbox and check the “Mask variable” checkbox.


Add another variable in GitLab named SONAR_HOST_URL and provide the value given in SonarQube. Uncheck the “Protect variable” checkbox.


Add the .gitlab-ci.yml file in GitLab project for continuous integration.


  - sonarqube-check

  stage: sonarqube-check
      - sonarqube  # name of gitlab runner tag
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"  # Defines the location of the analysis task cache
    GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required by the analysis task
    key: "${CI_JOB_NAME}"
      - .sonar/cache
    - sonar-scanner
  allow_failure: true
    - main # the name of branch

Pipeline Execution:


SonarQube Project :

We can see the detailed analysis of code in SonarQube project.



We have integrated SonarQube with GitLab CI Pipeline for seamless workflow that not only automates repetitive tasks but also provides valuable feedback on code quality and bridges the gap between code development and code analysis.

Đăng ký liền tay Nhận Ngay Bài Mới

Subscribe ngay

Cám ơn bạn đã đăng ký !

Lỗi đăng ký !

Add Comment

Click here to post a comment

Đăng ký liền tay
Nhận Ngay Bài Mới

Subscribe ngay

Cám ơn bạn đã đăng ký !

Lỗi đăng ký !