gulp-sonar-next

Run SonarQube / SonarCloud analysis from a gulp task, powered by the modern, officially maintained @sonar/scan Node scanner.

This is the next-generation successor to gulp-sonar2. Instead of bundling a Java scanner, it delegates to @sonar/scan, which downloads the correct SonarScanner automatically and works with current SonarQube servers and SonarCloud.

Why this over gulp-sonar2?

• No Java, no bundled jar. @sonar/scan fetches the right scanner for you, so the package is a few KB instead of ~600 KB.
• Works with modern SonarQube. The legacy 3.x scanner no longer plays well with current servers.
• Token auth. Uses the modern token flow (the old jdbc database config was removed from SonarQube years ago).

Requirements

• Node.js >= 22.12.0 (required by @sonar/scan 5.x)
• This package is ESM only (import, not require)
• Access to a SonarQube server or SonarCloud, plus an analysis token

Install

npm install --save-dev gulp-sonar-next

Usage

import gulp from 'gulp';
import sonar from 'gulp-sonar-next';
import log from 'fancy-log';

export function scan() {
    const options = {
        serverUrl: 'https://sonarqube.mycompany.com',
        token: process.env.SONAR_TOKEN,
        options: {
            'sonar.projectKey': 'my-project',
            'sonar.projectName': 'My Project',
            'sonar.projectVersion': '1.0.0',
            'sonar.sources': 'src',
            'sonar.tests': 'test',
            'sonar.javascript.lcov.reportPaths': 'coverage/lcov.info'
        }
    };

    // The gulp source is ignored; analysis scope comes from the options above
    // (e.g. sonar.sources). This mirrors the original gulp-sonar2 contract.
    return gulp.src('.', { read: false })
        .pipe(sonar(options))
        .on('error', log.error);
}

You can also skip gulp's file glob entirely and just return the stream from a task; the scanner reads the filesystem based on sonar.sources.

Options

The plugin accepts an object with three top-level fields, matching @sonar/scan:

| Field | Type | Description | |---|---|---| | serverUrl | string | SonarQube/SonarCloud URL. Falls back to SONAR_HOST_URL. | | token | string | Analysis token. Falls back to SONAR_TOKEN. | | options | object | Scanner properties as sonar.* keys (e.g. sonar.sources). |

Full list of scanner properties: SonarScanner parameters.

Migrating from gulp-sonar2

For a smoother move, the plugin also accepts a legacy sonar block similar to gulp-sonar2 and folds it into scanner properties:

sonar({
    sonar: {
        host: { url: 'https://sonarqube.mycompany.com' },
        login: process.env.SONAR_TOKEN, // legacy field name, mapped to token
        projectKey: 'my-project',
        sources: 'src'
    }
});

Note the important differences from gulp-sonar2:

• The bundled Java scanner is gone; nothing to configure for Java.
• The jdbc database block is not supported (removed from SonarQube long ago).
• Authenticate with a token (or the legacy login field), not a DB user.

Error handling

The plugin emits errors on the stream rather than throwing, so attach an error handler as shown above. The task fails if @sonar/scan reports an analysis error (for example, the server is unreachable or the token is invalid).

License

Apache-2.0