SonarQube — Code Quality

URL: https://sonarqube.enfection.com

What is SonarQube?

SonarQube automatically scans your PHP code every time you push to the staging branch. It checks for:

Check	What it finds
Bugs	Code that will likely cause errors
Vulnerabilities	Security issues (SQL injection, XSS etc.)
Code Smells	Poor code practices that make code hard to maintain
Duplications	Copy-pasted code blocks
Coverage	Untested code (if tests exist)

How it works in the Pipeline

Developer pushes to staging branch
        ↓
GitHub Actions: SonarQube Scan job runs
        ↓
Code sent to sonarqube.enfection.com
        ↓
Results available in SonarQube dashboard
        ↓
If scan passes → Deploy to staging ✅
If scan fails  → Deploy blocked ❌

Checking SonarQube Results

https://sonarqube.enfection.com
→ Login → Projects → select your project

Quality Gate Status

Status	Meaning
✅ Passed	Code quality is good — deploy continues
❌ Failed	Issues found — fix before merging to production

Reading the Dashboard

Bugs          → Must fix (will cause errors)
Vulnerabilities → Must fix (security risk)
Code Smells   → Should fix (tech debt)
Duplications  → Consider refactoring

What to do if Pipeline Fails (SonarQube)

Step 1 — Check GitHub Actions log:

github.com/[org]/[repo-name]/actions
→ Click failed run → SonarQube Scan → expand logs

Step 2 — Check SonarQube dashboard:

https://sonarqube.enfection.com
→ Projects → your project → Issues tab
→ Filter by: Bugs / Vulnerabilities

Step 3 — Fix the issues in your code, then push again:

git add .
git commit -m "fix: resolve sonarqube issues"
git push origin staging

DevOps — SonarQube Admin

Access

URL:      https://sonarqube.enfection.com
Username: admin
Password: (team password manager)

Generate Global Token (one-time setup)

My Account → Security → Generate Tokens
→ Name: enfection-global
→ Type: User Token
→ Generate → Copy → save to ~/.enfection-config

Server Management

ssh ubuntu@[sonarqube-server-ip]
cd /opt/sonarqube

docker-compose ps           # Check status
docker-compose restart      # Restart
docker logs sonarqube -f    # View logs

Projects auto-created

SonarQube automatically creates a new project on first scan using sonar.projectKey from sonar-project.properties. No manual setup needed per project.

sonar-project.properties (per project)

Located in theme root folder. Generated automatically by new-project.sh:

sonar.projectKey=rocell-wordpress-theme
sonar.projectName=Rocell Website WordPress Theme
sonar.projectVersion=1.0
sonar.sources=.
sonar.exclusions=node_modules/**,assets/**,languages/**,**/*.min.js,**/*.min.css,**/*.map,docker/**
sonar.language=php
sonar.php.version=8.2