sonar-scanner

library3.1.0jsnpmunverified

The `sonar-scanner` npm package serves as a convenient Node.js wrapper for the official, Java-based SonarQube Scanner command-line interface. It simplifies the integration of SonarQube code analysis into Node.js projects by providing an `npm install` and `npm run` entry point, eliminating the need for manual downloads and path configurations of the SonarQube Scanner CLI. The current stable version, 3.1.0, was last published in February 2021. While the wrapper itself has seen limited recent development, its primary function is to proxy commands to the underlying SonarQube Scanner, which continues to evolve independently. Its key differentiator is providing a straightforward Node.js ecosystem entry for SonarQube analysis, primarily aimed at CI/CD pipelines within JavaScript/TypeScript projects.

devops testing

npm install sonar-scanner

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SONAR-SCANNER

sonar-scanner

devopsjavascriptv3.1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sonar-scanner (CLI)

✓ /* Use via npm script: `npm run sonar-analysis` after configuring in package.json */

✗ import { sonarScanner } from 'sonar-scanner';

This package is a CLI wrapper and does not expose a programmatic JavaScript API. Direct ES module imports are not supported.

sonar-scanner (CLI)

✓ /* Use via shell: `node_modules/.bin/sonar-scanner` */

✗ const sonarScanner = require('sonar-scanner');

CommonJS `require()` is not applicable as this package provides a command-line executable, not a module for programmatic use.

Type definitions

✓ /* No specific TypeScript types are exported by this wrapper. */

✗ import type { SonarConfig } from 'sonar-scanner';

As a CLI wrapper, this package typically does not offer dedicated TypeScript types for its usage. Configuration is primarily via command-line arguments or `sonar-project.properties`.

Demonstrates how to integrate `sonar-scanner` into a Node.js project's `package.json` scripts for SonarQube analysis, configuring basic project properties and token authentication.

{ "name": "my-node-project", "version": "1.0.0", "description": "A simple Node.js project for SonarQube analysis.", "main": "index.js", "scripts": { "sonar-analysis": "sonar-scanner -Dsonar.projectKey=my_nodejs_project -Dsonar.projectName='My Node.js Project' -Dsonar.sources=./src -Dsonar.typescript.tsconfigPath=./tsconfig.json -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=your_organization_key -Dsonar.token=${SONAR_TOKEN:-}" }, "devDependencies": { "sonar-scanner": "^3.1.0" } } // To run the analysis after `npm install`: // npm run sonar-analysis // The SONAR_TOKEN environment variable should be set in your CI/CD pipeline // or locally for authentication (e.g., SONAR_TOKEN=your_token npm run sonar-analysis).

sonar-scanner --version

Debug

Known issues

gotchaThe underlying SonarQube Scanner is a Java application. A Java Runtime Environment (JRE) or Java Development Kit (JDK) must be installed on the system where `sonar-scanner` is executed for it to function correctly.

fix

Ensure Java (JRE/JDK 11 or higher, depending on SonarQube server version) is installed and accessible in your system's PATH.

affects: >=1.0.0

gotchaThis npm package is a wrapper for the SonarQube Scanner CLI tool and does not provide a programmatic JavaScript/TypeScript API. It cannot be imported or used directly within your JS/TS code.

fix

Always invoke `sonar-scanner` via `npm scripts` or directly from `node_modules/.bin/sonar-scanner` as a command-line tool.

affects: >=1.0.0

gotchaThe `sonar-scanner` wrapper (version 3.1.0) was last updated in February 2021. While functional, it might not support the latest features or configurations introduced in more recent versions of the official SonarQube Scanner or SonarQube server.

fix

Review the official SonarQube documentation for the latest scanner capabilities and consider if a newer wrapper or direct use of the official scanner is necessary for advanced features or compatibility with very new SonarQube server versions.

affects: <=3.1.0

gotchaSonarQube analysis requires proper configuration, typically via command-line arguments passed to `sonar-scanner` or a `sonar-project.properties` file in the project root. Missing essential properties (like `sonar.projectKey`, `sonar.sources`) will cause the analysis to fail.

fix

Provide all mandatory SonarQube properties either inline in your `npm script` (e.g., `-Dsonar.projectKey=my-key`) or in a `sonar-project.properties` file.

affects: >=1.0.0

Errors

Common errors & fixes

ERROR: JAVA_HOME is not set and Java command is not in PATH.

The system where `sonar-scanner` is being executed lacks a properly configured Java Runtime Environment (JRE) or Java Development Kit (JDK).

fix

Install a supported Java version (e.g., OpenJDK 11 or newer) and ensure `JAVA_HOME` is set to its installation directory, and the `bin` directory is in your system's PATH.

Property 'sonar.projectKey' is missing.

The mandatory `sonar.projectKey` property, which uniquely identifies your project on the SonarQube server, was not provided.

fix

Add `-Dsonar.projectKey=<your-project-key>` to your `sonar-scanner` command in `package.json` or define it in your `sonar-project.properties` file.

Failed to upload report: Not authorized.

The provided SonarQube token either has insufficient permissions, is incorrect, or is missing entirely.

fix

Ensure the `SONAR_TOKEN` environment variable is correctly set with a valid token, or pass it via `-Dsonar.token=your_token` in the command. Verify the token's permissions on the SonarQube server.

Upgrade

Version history

3.1.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

18 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/bcaudan/node-sonar-scanner ↗

packagehttps://www.npmjs.com/package/sonar-scanner ↗

homepagehttps://sonarqube.org/ ↗