NPM module to run SonarQube Server and Cloud analyses

@sonar/scan makes it very easy to trigger SonarQube Server and Cloud analyses on a JavaScript code base, without needing to install any specific tool or (Java) runtime.

This module is analyzed on SonarQube Cloud.

This is the documentation for v5. If you are using v4, refer to the v4 documentation. If you are using v3, refer to the v3 documentation.

Installation

Prerequisite: Node v22.12.0+ (for v5 and above)

Prerequisite: Node v18+ (for v4)

Prerequisite: Node v16+ (for v3, otherwise use sonarqube-scanner v2.9.1)

This package is available on npm as: @sonar/scan

To install the scanner globally and be able to run analyses on the command line:

npm install -g @sonar/scan

Getting Started

If you want to run an analysis without having to configure anything in the first place, simply run the sonar-scanner-npm command. The following example assumes that you have installed SonarQube Server locally:

cd my-project
sonar-scanner-npm

The deprecated sonar and sonar-scanner executable aliases were removed in v5. Update global invocations and package scripts to use sonar-scanner-npm instead.

or you can use npx without installing:

cd my-project
npx @sonar/scan

JavaScript API

@sonar/scan v5 is published as an ES module. Use import syntax when calling it from ESM JavaScript:

import { scan } from '@sonar/scan';

await scan({
  serverUrl: 'http://localhost:9000',
  token: process.env.SONAR_TOKEN,
});

To force the scanner to use a locally installed sonar-scanner executable:

import { customScanner } from '@sonar/scan';

await customScanner({
  serverUrl: 'http://localhost:9000',
  token: process.env.SONAR_TOKEN,
});

For CommonJS projects, load @sonar/scan with dynamic import() instead of require():

async function run() {
  const { scan } = await import('@sonar/scan');
  await scan({
    serverUrl: 'http://localhost:9000',
    token: process.env.SONAR_TOKEN,
  });
}

run();

Documentation

For the extended information, please refer to its documentation.

License

@sonar/scan is licensed under the LGPL v3 License.