skills.rest
edercnj
edercnjCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

x-run-sonar-security

Run SonarScanner, evaluate quality gates, and generate SARIF reports.

Updated Aug 27, 2026
Search Tags:#security#quality-gate#ci-cd#sonarqube#sonarcloud#sarif#sonarscanner
One-click install
npx skills add https://github.com/edercnj/ia-dev-environment --skill x-run-sonar-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: x-run-sonar-security
Source: https://github.com/edercnj/ia-dev-environment/tree/main/src/main/resources/claude/skills/x-run-sonar-security
Command: npx skills add https://github.com/edercnj/ia-dev-environment --skill x-run-sonar-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Integrates SonarQube/SonarCloud to enforce security hotspots tracking, quality gate enforcement, and SARIF reporting across CI/CD pipelines.

Core Features & Use Cases

  • Generate sonar-project.properties and auto-detect analysis configuration for your repository.
  • Execute SonarScanner, monitor quality gate status, and fail the build on non-OK gates.
  • Produce SARIF output and a Markdown report summarizing hotspots and vulnerabilities with actionable recommendations.
  • Support default and strict quality gate modes to fit standard and release pipelines.

Quick Start

Run the skill with your SonarQube server URL and token to start analysis.

Frequently Asked Questions about x-run-sonar-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce a SonarQube quality gate in a CI pipeline and fail the build on security hotspots?▼

To enforce a SonarQube quality gate in a CI pipeline, you need a tool that executes SonarScanner and polls the server status. This skill automates that evaluation, failing the build automatically when the quality gate is not OK due to security hotspots.

Do I need to manually create sonar-project.properties before running a SonarScanner analysis?▼

No, you do not need to manually create sonar-project.properties before running a SonarScanner analysis. This skill generates the file automatically and auto-detects the required analysis configuration for your repository.

Can I generate SARIF reports for SonarQube security vulnerabilities?▼

Yes, you can generate SARIF reports for SonarQube security vulnerabilities. The skill produces SARIF output and a Markdown report summarizing detected hotspots alongside actionable recommendations for fixing them.

What is required to run SonarCloud analysis from a local environment or CI runner?▼

To run SonarCloud analysis, the SonarScanner CLI must be available on your PATH. You also need a valid server URL and token, with optional project-key and branch parameters to target the specific analysis correctly.

What is the difference between default and strict quality gate modes for SonarQube?▼

The difference between default and strict quality gate modes is their enforcement severity. Default mode fits standard pipelines, while strict mode is designed for release pipelines to apply more rigorous security hotspot tracking and quality gate enforcement.

Related Skills

Explore More Software Engineering Skills→
etendosoftwareetendosoftware
1

etendo-sonar

Run SonarQube analysis on Etendo modules and fix code issues.

Official
Advanced
SuperlendSuperlend

sarif-parsing

Parse SARIF 2.1.0 files and extract structured findings for reporting.

Official
Intermediate
fabiolpgomesfabiolpgomes

aiox-devops

Enforce quality gates and orchestrate GitHub releases with semantic versioning.

Community
Advanced
ollieb89ollieb89

sast-configuration

Configures SAST tools like Semgrep, SonarQube and CodeQL for automated vulnerability detection in CI/CD pipelines.

Community
Advanced