TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

SonarQube Integration with MSBuild and Team Build

29 posts · Sep 2013 – May 2018

What this trail covers

This thread tracks the evolution of SonarQube integration with Azure DevOps and Team Foundation Server for static code analysis and technical debt management. It covers MSBuild, Maven, and Gradle build tasks, pull request integration, Roslyn analyzer support, SonarLint for Visual Studio, dashboard widgets, secure SonarQube installations in Azure, and the integration of security and architecture dependency validation into the CI/CD pipeline. This post details the release of version 2.0 of the Son

All Microsoft trails
  1. Shift Left with SonarCloud Pull Request IntegrationThis post details the integration of SonarCloud with Visual Studio Team Services (VSTS) pull requests. It describes setting up a CI build to run SonarCloud analysis, configuring PR build policies for validation, and implementing status policies to block merges based on code quality checks. The post highlights how SonarCloud comments directly on PRs to indicate code smells and other issues, allowing reviewers to see and address them without leaving the PR view. It also explains how to set up a policy to require successful code quality checks for all pull requests, ensuring a higher quality standard before merging.
  2. Team Services Extensions Roundup - AprilThis post announces the release of the NDepend Extension for TFS 2017 and VSTS, which integrates NDepend's static analysis capabilities into the CI/CD process. It introduces a new build task for code analysis and coverage, a dashboard hub for code quality metrics, quality gates, over 150 default rules, technical debt and issue tracking, trend charts, code metrics display, and build summary recaps. It also highlights the AWS S3 Upload extension, which adds a build task for uploading files to S3 buckets, requiring AWS Tools for Windows PowerShell and AWS CLI configuration.
  3. SonarSource have announced their own SonarQube Team Services / TFS integrationThis post announces the deprecation of Microsoft's SonarQube MSBuild build tasks for Visual Studio Team Services (VSTS) and Team Foundation Server (TFS). Ownership of these tasks is transferred to SonarSource, who will now provide their own SonarQube extension on the VSTS marketplace. This extension includes the previously deprecated 'SonarQube for MSBuild – Begin Analysis' and 'SonarQube for MSBuild – End Analysis' tasks, as well as a new 'SonarQube Scanner CLI' task for analyzing projects beyond MSBuild and Java. Minor breaking changes include a dedicated 'SonarQube' endpoint and the removal of database connection input fields from the build step. Support for Java build tasks for Maven and Gradle remains with Microsoft for now.
  4. Maven and Gradle build tasks support powerful code analysis toolsThis post announces the addition of SonarQube integration for Maven and Gradle builds, bringing parity with existing MSBuild integration. It introduces the ability to select SonarQube analysis via a checkbox in build definitions, create build summaries of detected issues, and break builds when SonarQube quality gates fail. Additionally, it adds support for PMD, Checkstyle, and FindBugs for Java-based static analysis tools, configurable via checkboxes in the 'Code Analysis' section of build configurations. Support for pull request code analysis for Java projects is planned for the future.
  5. Maven and Gradle build task support Checkstyle analysisThis post introduces Checkstyle analysis support for Gradle build tasks, with planned support for Maven. It details how to enable the 'Run Checkstyle' box in the Code Analysis section of the build task, which reports the number of issues found and makes detailed logs available under the build Artifact tab. It also guides users on customizing Checkstyle analysis by applying the Checkstyle plugin in Gradle or Maven builds, noting that the system will detect and use these configurations.
  7. Managing Technical Debt planning update - 2016Q3This post provides an update on the "Managing Technical Debt" planning for 2016Q3. It details the progress made in integrating SonarQube with MSBuild projects, including setting up CI builds in Team Services and TFS with MSBuild tasks, requesting quality gate status, and breaking builds on failure. It also covers SonarQube code analysis during pull requests for static analysis on JavaScript code, and the enablement of Roslyn analyzers through the SonarQube Roslyn SDK. For Maven and Gradle build tasks, it announces the upcoming parity of experience with MSBuild, including SonarQube analysis and pull request integration. Support for standalone Java static analysis tools like PMD is also highlighted, with plans to integrate more tools like CheckStyle and FindBugs. The post also mentions the development of a dashboard widget for SonarQube analysis builds and the ongoing work on secure SonarQube installations in Azure. Finally, it touches upon security flaws and architecture flaws as aspects of technical debt, with ongoing work on extensions and live validation in Visual Studio Enterprise.
  8. The Maven build task now supports PMD analysis out of the boxIntroduced out-of-the-box support for PMD static analysis within the Maven build task in Azure Pipelines. This feature allows users to enable PMD analysis via a checkbox, with results reported in the build summary and detailed logs available as build artifacts. The implementation currently works with Linux agents in Team Services and is planned for on-premises TFS in the next major version. Customization of PMD rules requires modifying the Maven pom file.
  9. The Gradle build task now supports SonarQube analysisAdds a Gradle build task to Visual Studio Team Services (VSTS) that allows users to trigger SonarQube analysis for Java projects. The task requires configuration of a SonarQube service endpoint, project name, key, and version. It also allows for passing custom SonarQube settings and chaining Gradle configurations. The post notes that this feature is currently limited to VSTS with Linux agents and will be available in the next major version of TFS.
  10. SonarQube Code Analysis issues integration into Pull RequestsThis post introduces the integration of SonarQube code analysis results directly into Visual Studio Team Services (VSTS) pull requests. When a build definition configured with SonarQube tasks runs as part of a Pull Request (PR), it performs an incremental analysis. New static analysis issues identified by SonarQube are then added as comments to the PR, similar to how a human reviewer would provide feedback. This allows developers to see and fix issues directly within their code review workflow. The post also explains how to configure CI and PR builds to leverage this feature and provides troubleshooting steps.
  11. SonarLint 2.2 for Visual Studio improves the connected modeSonarLint for Visual Studio 2.2 introduces several improvements: 1. Notifications for quality definition changes: A gold bar message appears in the Error list if the SonarQube project's quality profile has changed since the last sync, prompting a resync. 2. UI-based exclusion of projects from SonarQube analysis: Users can now exclude MSBuild projects or mark MSTest projects as test projects directly through the Visual Studio UI, simplifying configuration compared to editing project files. 3. Dedicated SonarLint tab in the Output window: Project binding feedback, including reasons for exclusion or test project status, is now logged in a dedicated SonarLint tab, improving visibility and debugging.
  12. SonarQube Scanner for MSBuild v1.1 released: static analysis now executed during the buildThis post announces the release of SonarQube Scanner for MSBuild v1.1 and SonarQube C# Plugin v4.4. The main change is the execution of SonarLint C# analysis rules during the build phase when using MSBuild 14.0, leading to more accurate results compared to post-build analysis. For MSBuild 12.0, the behavior remains post-build, but a warning is issued. This release is the first step towards supporting any Roslyn analyzer by uploading issues to SonarQube, with ongoing development of tooling to automatically generate SonarQube plugins for Roslyn analyzers.
  13. SonarLint for VisualStudio 2.1 released, brings consistency with MSBuild, navigation to SonarQube and notificationsSonarLint for Visual Studio 2.1 improves the 'connected mode' by aligning Roslyn analyzer provisioning with the SonarQube Scanner for MSBuild, preventing unnecessary analysis on test projects or excluded projects. It adds a 'View in SonarQube' command in Team Explorer for direct navigation to SonarQube projects and introduces notifications for quality definition discrepancies between the IDE and SonarQube, with an option to automatically fix weaker rulesets.
  14. SonarQube: SDK to build plugins for Roslyn Analyzers releasedReleased version 1.0 of the SDK for SonarQube Roslyn Analyzer Plugins. Key changes include removing the JDK requirement by injecting files into a pre-built jar, adding support for NuGet packages that require license acceptance with a new `/acceptLicenses` option, and introducing basic support for remediation data by generating a template XML file for SQALE information which can be further customized.
  15. Bind a Visual Studio solution to a SonarQube project provisions and configures Roslyn analyzersIntroduces the "SonarQube connected mode" in SonarLint for Visual Studio 2.0, enabling Visual Studio solutions to bind to SonarQube projects. This feature automatically provisions required Roslyn analyzers as NuGet packages and configures project rulesets to match the SonarQube Quality Profile. This resolves discrepancies between IDE warnings and build analysis results, providing a consistent developer experience. The post details the process of binding a solution, the changes made to the solution (new ruleset files, NuGet package installations), and outlines current limitations and future improvements.
  16. SonarQube Scanner for MSBuild v2.0 released: support for third-party Roslyn analyzersThis post announces the release of SonarQube Scanner for MSBuild v2.0 and SonarQube C# Plugin v4.5, which introduce support for third-party Roslyn analyzers. It outlines the process for SonarQube administrators and Roslyn analyzer authors to integrate these analyzers, detailing the runtime collaboration between the scanner, C# plugin, and generated plugins. It also mentions the availability of an SDK for creating SonarQube Roslyn Analyzer Plugins and previews future improvements to the authoring experience and IDE integration.
  17. Use SonarQube quality gates to control your Visual Studio Team Services buildsThis post introduces the capability to fail Azure DevOps/TFS builds based on SonarQube quality gate violations. For SonarQube 5.3+, this is achieved via a checkbox in the 'SonarQube for MSBuild – Begin Analysis' build task. For earlier versions, the 'Build Breaker' plugin (for 4.x) or upgrading to 5.3+ is recommended. It advises against performing SonarQube analysis on pull request builds due to uploading uncommitted code results, and explains the importance of managing project versioning for accurate quality gate evaluation.
  18. SonarQube Integration Update and 2016H1 PlansThis post provides an update on SonarQube integration with Visual Studio Team Services (VSTS) and Team Foundation Server (TFS). It details features shipped in the previous period, including SonarQube analysis of .NET projects integrated with MSBuild, build tasks for SonarQube analysis in VSTS/TFS, a TFVC plugin for SonarQube, LDAP plugin for Active Directory authentication, and support for Azure SQL databases. It also outlines plans for 2016H1, focusing on provisioning and configuring Roslyn analyzers from SonarQube Quality Profiles, improved build summaries, dashboard widgets, and Azure AD integration.
  19. SonarQube Scanner for MSBuild v1.1 released: static analysis now executed during the buildIntroduced the ability to run SonarLint C# analysis rules during the build phase when using MSBuild 14.0, improving accuracy by analyzing complete project code. For MSBuild 12.0, analysis remains post-build, with a warning to upgrade. This release is the first step towards supporting any Roslyn analyzer in SonarQube, with ongoing development of tooling to generate SonarQube plugins for Roslyn analyzers.
  20. Support for Active Directory and Single Sign On (SSO) in the SonarQube LDAP PluginThis post details version 1.5 of the SonarQube LDAP Plugin, which simplifies configuration for Active Directory environments by reducing the number of required properties in `sonar.properties`. It introduces support for Single Sign On (SSO) using NTLM or Kerberos, automatically signing users into SonarQube using their Active Directory credentials. Additionally, it allows for the direct addition of security groups to the SonarQube server with permission assignment, using the format `groupname@domain`.
  21. Support for Team Foundation Server 2015 in SonarQube TFVC SCM PluginIntroduces version 2.1 of the SonarQube TFVC SCM plugin, adding support for Team Foundation Server 2015. This version requires the `sonar.tfvc.collectionuri` property to be configured and execution from Windows machines with the TFS 2013 Object Model installed. Hosted builds are not supported.
  22. MSBuild.SonarQube.Runner v1.0.2 released (and renamed)Announces MSBuild.SonarQube.Runner v1.0.2 (renamed to SonarQube Scanner for MSBuild). Key changes include: credentials are no longer stored in plain text temporary files (requiring explicit passing in begin/end phases), relative path arguments are now resolved correctly relative to the current command line directory, compatibility requirements (MSBuild 12.0+, .NET 4.5.2) are clarified, and C# plugin analysis rules are updated with SonarLint for Visual Studio 1.3.0.
  23. The Maven build task now simplifies SonarQube analysisIntroduced an updated Maven task for Visual Studio Online and Team Foundation Server 2015 (Update 1) that simplifies triggering SonarQube analysis for Java projects. The task automatically adds project name, key, and version to the Maven POM file. It supports configuring SonarQube server URL, credentials via Service Endpoints, and database connection strings for older SonarQube versions. Customization is possible via the POM file or 'Options' setting. Test failures in Maven goals do not halt SonarQube analysis.
  24. Quickstart: Analyzing .NET projects with SonarQube, MSBuild or Visual Studio Online, and third-party analyzers (StyleCop, ReSharper)This post details the integration of SonarQube with MSBuild and Visual Studio Online (VSO)/Team Foundation Server (TFS) builds. It provides a quick-start guide for local SonarQube server installation, running analyses with MSBuild.SonarQube.Runner 1.0.1, and incorporating third-party analyzers like StyleCop and ReSharper. It explains how to configure SonarQube quality profiles and activate rules for StyleCop, and demonstrates re-running analysis to include StyleCop issues. The post also touches on running analysis with Build vNext tasks in VSO/TFS.
  25. SonarQube Integration PlansThis post details the ongoing integration plans for SonarQube with Azure DevOps (VSO/TFS) and Visual Studio. It announces the release of MSBuild.SonarQube.Runner v1.0.2 with bug fixes and compatibility updates. It also outlines future plans including Java build tasks for Maven, Ant, and Gradle, a Tech Debt Report in build summaries, Active Directory integration for SSO, one-click SonarQube installation, a SonarQube widget for VSO/TFS dashboards, and updates to the TFVC SonarQube plugin. Furthermore, it discusses plans for tracking SonarQube issues in the backlog, filtering issues in Visual Studio based on baselines and modified code, and enforcing quality gates on pull requests.
  26. MSBuild.SonarQube.Runner 1.0.1 ReleasedThis post announces the release of MSBuild.SonarQube.Runner 1.0.1, focusing on bug fixes and improvements for more robust execution, succinct console output, better error messages, improved detection of test projects, and better detection of generated code. Key changes include disabling the old VS Bootstrapper plug-in, making the SonarQube.Analysis.xml file non-locking, allowing analysis without Visual Studio installed (though code coverage will be lost), reducing console output verbosity, providing more actionable error messages for self-signed HTTPS certificates and incorrect server URLs, and refining test project detection logic to avoid analyzing folders with 'test' in their name unless the project filename itself contains 'test'. Generated files from XAML and those in the _obj_ folder are now also ignored.
  27. Build Tasks for SonarQube AnalysisThis post introduces two new Azure DevOps build tasks: 'SonarQube for MSBuild – Begin Analysis' and 'SonarQube for MSBuild – End Analysis'. These tasks automate the integration of SonarQube static code analysis into Azure Pipelines and Visual Studio Online build definitions. The 'Begin Analysis' task configures the SonarQube server, project properties, and database settings (for SonarQube versions prior to 5.2), and prepares MSBuild for analysis. The 'End Analysis' task finalizes the analysis and sends results to the SonarQube server. The post details the configuration of these tasks, including setting up service endpoints for the SonarQube server and using build variables for sensitive database parameters. It also confirms that these tasks can be used with hosted agents, provided the SonarQube server is internet-accessible.
  28. MSBuild and Team Foundation Server integration with SonarQube: version 1.0 releasedThis post announces the release of MSBuild.SonarQube.Runner 1.0, which improves upon version 0.9 by simplifying installation, enabling execution of additional SonarQube plugins, allowing for command-line local analysis, accepting source files beyond C# (including TypeScript), fixing bugs, and adding support for analyzing code in Visual Studio Online. It also mentions the availability of updated SonarQube C# and VB.NET plugins and an open-source guidance document for installation and upgrading from v0.9.
  29. Technical Debt Management: Announcing SonarQube integration with MSBuild and Team BuildThis post announces the availability of integration components for configuring Team Foundation Server (TFS) Build to connect to a SonarQube server. These components allow sending .NET and JavaScript code analysis results, code clone analysis, code coverage data, and metrics to SonarQube. The integration is targeted for TFS 2013 and above. It also mentions ongoing work for Visual Studio Online integration and the release of SonarLint .NET rules for live analysis in Visual Studio 2015.
  30. Perform Java code analysis with Team Foundation Server and SONARThis post details how to integrate Java projects with Team Foundation Server (TFS) and SonarQube for code analysis. It outlines the use of Eclipse, Team Explorer Everywhere, TFS Build Extensions, Apache Ant, and the SonarQube Ant Task. The scenario involves developers working in Eclipse, pushing changes to TFS, and triggering a build that includes SonarQube analysis. The results are published to the SonarQube portal for review. The post provides step-by-step instructions for installing and configuring the necessary tools and modifying the Ant build script to incorporate SonarQube analysis.