Update: Sonatype now has it's own code quality service: Sonatype Lift.
Many development organizations we work with have turned to SonarQube as a dashboard to visualize and measure their code quality.
Customers using CLM want to surface known security vulnerabilities and license risk in the same place developers or executives already go to assess the overall quality of their application. To support this growing interest from our customers, we are introducing our next important milestone: Sonatype CLM’s integration with SonarQube.
Figure 1. SonarQube widget example highlights open source policy violations that require attention. Drill down reports with with detailed analysis are accessible directly from this widget.
This integration will allow you to access summary-level Sonatype CLM information for your applications, as well as link to Sonatype CLM Application Composition Reports directly from your SonarQube projects.
Figure 2. Sonatype CLM Application Composition Reports offer detailed analysis of license and security issues down to the individual components and risks.
Better component usage doesn’t just lead to risk reduction though, it also leads to better applications. This is something that ties closely with code analysis, and tools such as SonarQube.
If you are already using SonarQube, you know first hand the impact that principles such as the 7 Axes of Code Quality can have on the applications and projects your teams create. Paralleling this, as a user of Sonatype CLM you also know how using good components is a critical and essential part of developing quality applications. Sonatype CLM for SonarQube brings both of these together.
-
THE SOFTWARE: For Sonatype CLM users needing access to the 1.11 release, it can be found on our KnowledgeBase here.
-
THE INTEGRATION: For Sonatype CLM users looking for more information on the SonarQube integration, you can quickly get up-and-running with our online guides.
-
LEARN MORE: What to learn more about SonarQube? Here is an informative article I found from Nadeem Mohammad.
Finally, if you are looking for information on how Sonatype CLM integrates into your complete development environment, here are some links that you might find helpful:
-
Sonatype CLM integrates with continuous integration servers (e.g., Hudson/Jenkins),
-
Sonatype CLM integrates with IDEs (e.g., Eclipse)
-
Sonatype CLM integrates with repository management (e.g., Nexus)
-
Sonatype CLM integrates with build managers (e.g., Maven)
.jpg)