Integrate SonarQube with Jenkins Groovy Pipeline for Code Quality Analysis

In modern software development, code quality plays a vital role in maintaining reliable and maintainable applications. As part of a DevSecOps or CI/CD workflow, integrating SonarQube with Jenkins helps automate static code analysis, detect vulnerabilities early, and enforce quality gates before deployment.

In this article, you’ll learn how to integrate SonarQube with a Jenkins Groovy pipeline step by step for seamless code quality analysis.

What is SonarQube?

SonarQube is an open-source platform used to continuously inspect code quality. It analyzes your source code for:

Bugs and vulnerabilities
Code smells
Code duplications
Test coverage

It supports multiple languages such as Java, JavaScript, Python, Go, C#, and more.

Why Integrate SonarQube with Jenkins?

Jenkins automates your build, test, and deployment workflows. When integrated with SonarQube, it adds automated code scanning to your CI/CD pipeline, ensuring every commit is tested for quality before deployment.

Key benefits:

Early detection of code issues
Enforced quality gates
Continuous code quality visibility
Improved team collaboration

Prerequisites

Before you begin, ensure the following:

SonarQube Server is installed and accessible (e.g., http://sonarqube.example.com).
SonarQube Scanner plugin is installed in Jenkins.
SonarQube token is generated for authentication.
Jenkins has access to your Git repository.
Java or Node.js project (for demonstration).

Step 1: Configure SonarQube in Jenkins

Go to Manage Jenkins → System.
Scroll to SonarQube servers and click Add SonarQube.
Enter:
- Name: SonarQube
- Server URL: http://sonarqube.example.com
- Server authentication token: (paste your token) “Store the Token as Secret Text”
Save the configuration.

Step 2: Install SonarQube Scanner

Navigate to Manage Jenkins → Global Tool Configuration.
Under SonarQube Scanner, click Add SonarQube Scanner.
Set a name (e.g., SonarScanner) and choose “Install automatically.”
Save changes.

Step 3: Create Jenkinsfile (Groovy Pipeline Script)

Here’s a sample Groovy pipeline integrating SonarQube:

        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv("${SONARQUBE}") {
                    script{

                    def scannerHome = tool 'SonarScanner'

                    sh """
                        echo "Running SonarQube Analysis..."
                        ${scannerHome}/bin/sonar-scanner \
                           -Dsonar.projectKey=pdp-audit-be \
                           -Dsonar.sources=. \
                           -Dsonar.sourceEncoding=UTF-8
                    """
                    }
                }
            }
        }

        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv("${SONARQUBE}") {
                    script{

                    def scannerHome = tool 'SonarScanner'

                    sh """
                        echo "Running SonarQube Analysis..."
                        ${scannerHome}/bin/sonar-scanner \
                           -Dsonar.projectKey=pdp-audit-be \
                           -Dsonar.sources=. \
                           -Dsonar.sourceEncoding=UTF-8
                    """
                    }
                }
            }
        }

Here’s a sample Groovy pipeline Direct integrating SonarQube:

For this you have to store the SonarQube Token into Jenkins Credentials and pass the Credentials ID as per the below example

        stage('SonarQube Analysis') {
            environment {
                scannerHome = tool 'SonarScanner' // Tool name which you have set
            }
            steps {
                withSonarQubeEnv('SonarQube') {
                    withCredentials([
                        usernamePassword(
                            credentialsId: 'sonarqube', // SonarQube Credintials ID
                            usernameVariable: 'SONAR_USER', 
                            passwordVariable: 'SONAR_TOKEN' 
                        )
                    ]) {
                        sh """
                            ${scannerHome}/bin/sonar-scanner \
                            -Dsonar.projectKey=PROJECT_NAME \  # replace it with your project name
                            -Dsonar.sources=. \
                            -Dsonar.host.url=SONARQUBE_URL \   # replace it with your sonarqube url
                            -Dsonar.token=${SONAR_TOKEN}       
                        """
                    }
                }
            }
        }

        stage('SonarQube Analysis') {
            environment {
                scannerHome = tool 'SonarScanner' // Tool name which you have set
            }
            steps {
                withSonarQubeEnv('SonarQube') {
                    withCredentials([
                        usernamePassword(
                            credentialsId: 'sonarqube', // SonarQube Credintials ID
                            usernameVariable: 'SONAR_USER', 
                            passwordVariable: 'SONAR_TOKEN' 
                        )
                    ]) {
                        sh """
                            ${scannerHome}/bin/sonar-scanner \
                            -Dsonar.projectKey=PROJECT_NAME \  # replace it with your project name
                            -Dsonar.sources=. \
                            -Dsonar.host.url=SONARQUBE_URL \   # replace it with your sonarqube url
                            -Dsonar.token=${SONAR_TOKEN}       
                        """
                    }
                }
            }
        }

✅ Explanation:

withSonarQubeEnv('SonarQube') injects SonarQube environment variables.
waitForQualityGate ensures the build waits for SonarQube analysis results.
If the quality gate fails, the pipeline automatically stops.

Step 4: Run the Pipeline

Push your Jenkinsfile to your Git repository.
Create a new Jenkins pipeline project pointing to that repo.
Run the build — Jenkins will automatically analyze your code in SonarQube.
Visit your SonarQube dashboard to view detailed reports.

Step 5: View Results in SonarQube

You’ll see metrics such as:

Code coverage
Maintainability rating
Security hotspots
Duplications and complexity

You can also define Quality Gates in SonarQube (e.g., coverage > 80%, no critical issues).

Best Practices

Always use tokens instead of passwords for Jenkins–SonarQube authentication.
Include SonarQube analysis in pull request validation pipelines.
Regularly update SonarQube plugins for the latest rule sets.
Integrate Trivy or other security scanners for container/image-level security.

Conclusion

Integrating SonarQube with Jenkins Groovy pipelines ensures continuous code quality checks as part of your CI/CD workflow. It not only maintains high standards for your codebase but also prevents vulnerabilities and technical debt from reaching production.

By automating code quality analysis, you enable developers to deliver cleaner, more secure, and maintainable software—faster.