[NEW PLUGIN] SonarQube plugin for the Go language

[Falque Thibault]

Hi all,

I proposed the first release of my SonarQube plugin for the Go language support and for 34 golint rules through GoMetaLinter.

Project site: https://github.com/uartois/sonar-golang

Issue tracking:https://github.com/uartois/sonar-golang/issues

Compatibility: SQ 6.0+, JRE 1.8+, GometaLinter.v1

Release notes: https://github.com/uartois/sonar-golang/releases/tag/v1.0.1

Download: https://github.com/uartois/sonar-golang/releases/download/v1.0.1/sonar-golang-plugin-1.0.1.jar

Quality Gate: https://sonarqube.com/dashboard?id=fr.univartois%3Asonar-golang-plugin

Any feedback or guidance much appreciated!

Thanks in advance,
Thibault.

[wang...@bytedance.com]

Great Job!  

I just want write a golang plugin, the saw your github repo.  Thanks for your work!

在 2017年4月22日星期六 UTC+8下午6:22:38，Falque Thibault写道：

[G. Ann Campbell]

Hi,

I forgot to mention earlier that I've added this to the Other Plugins page.

:-)

Ann

[Falque Thibault]

Hello,
Thanks for your answer.

If you have any problems or find a bug, do not hesitate to tell me.

TF.

[Falque Thibault]

Hi,

Thanks you very much for added the plugin to the Other "Plugin" page.

[skalaiy...@gmail.com]

HI Thibault,

I tried the go lang - sonar scanner as per your steps.

Sonarqube -> 6.3

sonar-golang-plugin-1.2.1.jar

I could see that goline profiles in sonarqube. I couldn't see anything which are related to bugs, Vulnerabilities, no of lines and all. 

Please help here and send if you have any sample project for go lang.

Regards,

Kalaiyarasan

[Falque Thibault]

Hi Kalaiyarasan,

Thanks for your feedback.

The plugin use the external tool "gometalinter" for generate a report. Have you generate this report ?

See this part of readme

If the problem is not solved. Please open a ticket here with the gometalinter report and the logs.

I hope will help you.

Regards.

Thibault.

 

--
You received this message because you are subscribed to a topic in the Google Groups "SonarQube" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sonarqube/y4RY0V9K8FI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/abaf9f74-6c01-4c96-9f07-3dfaeac729e1%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[blxd...@gmail.com]

Hi! I am having this same problem. The reports are generated in the report.xml, but not showing in the sonarqube UI. What am I doing wrong? 

Thanks!

To unsubscribe from this group and all its topics, send an email to sonarqube+...@googlegroups.com.

[G. Ann Campbell]

Hi,

Did you configure the path to that report as indicated in the documentation?

Ann

---

G. Ann Campbell | SonarSource

Product Manager

@GAnnCampbell

http://sonarsource.com

To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/f426864b-f242-4c83-9237-830c23de32d3%40googlegroups.com.

[blxd...@gmail.com]

I believe so! Set the sonar-project.properties file in the root directory of the project, ran the gometalinter.v1 to produce the report.xml file then scanned the project. The report.xml was modified to show the problem that was in the project, however, when I go to the UI of sonarqube using localhost, the project details show 0 bugs, 0 vulnerabilities and 0 code smells.

[Falque Thibault]

Ok. So do you have any error or info message in log concerning rules not supporting ?

To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/f93e3782-e136-4d75-aa7f-7a7fa395bd1d%40googlegroups.com.

[Daniel Koo]

No, I don't think so. The report.xml has the vulnerability that I created to make sure that my project had a problem. I'm just not seeing it appear in the sonarqube UI running it on localhost. After running the scan, are the results suppose to show in the UI ?

To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/f93e3782-e136-4d75-aa7f-7a7fa395bd1d%40googlegroups.com.

[G. Ann Campbell]

Hi,

There is likely to be a slight lag while the analysis report is being processed server-side, but yes.

First, you should check your analysis logs to see if there's anything relevant.

If that doesn't help you unravel this, then you should probably open an issue ticket on the project.

Ann

---

G. Ann Campbell | SonarSource

Product Manager

@GAnnCampbell

http://sonarsource.com

To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/f93e3782-e136-4d75-aa7f-7a7fa395bd1d%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to a topic in the Google Groups "SonarQube" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sonarqube/y4RY0V9K8FI/unsubscribe.

To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/CADMCq1SfptNi0qnirBmx24ygAZbTpsKWQ%2B-VoFFzP%3Dop2ZvfAQ%40mail.gmail.com.

[alix....@gmail.com]

Hi,
what is the reason why this plugin is not available in SonarQube 6.7 LTS?

/ Alix

[G. Ann Campbell]

Hi Alex,

If you're asking me, then the answer is that there has been no request from the maintainer(s).

Ann

--
You received this message because you are subscribed to a topic in the Google Groups "SonarQube" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sonarqube/y4RY0V9K8FI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/35c345ff-5e5f-475f-b5a9-6bb021a9d90f%40googlegroups.com.

[alix....@gmail.com]

Hi Ann,
I wasn't sure myself who to ask. It just felt strange with an active community developing the Go-lang plugin but no official distribution.
Hopefully someone will pick this up in https://github.com/uartois/sonar-golang/issues/44

/ Alix

[Daniel Le Berre]

Dear Ann,

This is an official request from a maintainer :)

Daniel

[G. Ann Campbell]

Hi Daniel,

Please take a look at the requirements here: https://docs.sonarqube.org/display/DEV/Deploying+to+the+Marketplace

:-)

Ann

---

G. Ann Campbell | SonarSource

Product Manager

@GAnnCampbell

https://sonarsource.com

--

You received this message because you are subscribed to a topic in the Google Groups "SonarQube" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sonarqube/y4RY0V9K8FI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/a28d8031-4427-4663-8abb-e749ad8356cd%40googlegroups.com.

[Thibault Falque]

Hello,

I would like my plugin for golang language to appear on the update center. 

I think it meets all the prerequisites and necessary requirements.

Here is a description of my plugin:

It integrates GoMetaLinter reports within SonarQube dashboard.

The user must generate a GoMetaLinter report for his code using the checkstyle format. The report is thus integrated to SonarQube using sonar-scanner.

Release 1.0 only provides golint support. Release 1.1 provides test coverage support. Upcoming releases will bring support for additional linters.

Url project: https://github.com/uartois/sonar-golang/blob/master/README.md
Sonarqube analysis: https://sonarcloud.io/dashboard?id=fr.univartois%3Asonar-golang-plugin%3Amaintenance

Thank you for considering my request,

Regards,

Le vendredi 15 décembre 2017 18:43:07 UTC+1, G. Ann Campbell a écrit :

Hi Daniel,

Please take a look at the requirements here: https://docs.sonarqube.org/display/DEV/Deploying+to+the+Marketplace

:-)

Ann

---

G. Ann Campbell | SonarSource

Product Manager

@GAnnCampbell

https://sonarsource.com

On Fri, Dec 15, 2017 at 2:45 PM, Daniel Le Berre <daniel....@gmail.com> wrote:

Dear Ann,

This is an official request from a maintainer :)

Daniel

--
You received this message because you are subscribed to a topic in the Google Groups "SonarQube" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sonarqube/y4RY0V9K8FI/unsubscribe.

To unsubscribe from this group and all its topics, send an email to sonarqube+...@googlegroups.com.

[G. Ann Campbell]

Hi guys,

In general this is a really solid plugin and you've done some nice work!

However, the timing on this is really unfortunate. We're planning to release SonarGo as an open source analyzer in early April, so while you meet most of the requirements for Marketplace inclusion, you do fall slightly afoul of the competition requirement. (Yes, I know you had no way of knowing, and you got started first! 😟 )

So as not to conflict with SonarGo, I need to ask you to:

* not to declare the Go language. SonarGo will do that and you'll be able to just use that declaration (you may want to declare a dependency). Yes, I know SonarGo isn't out yet, so again the timing on this ... is sub-optimal. 

* not declare a default rule profile for Go (altho you're quite welcome to declare as many non-default profiles as you like).

* not save the standard measures. SonarGo will do that & if you do it too, users with both will get errors during analysis

* not try to handle highlighting. SonarGo will take care of it

Beyond that, there are a couple other changes I need you to make before we can move forward with this

* after you deal with the removals required to kill the conflict, your plugin will no longer be a general plugin for the language(😞), so you need to update the plugin name and/or description (the one in the pom, which is what shows up in the Marketplace) to mention the MetaLinter.

* you've grabbed mostly top-level property keys, e.g. sonar.coverage.dtdVerification. Since your settings don't have global effect you need to "localize" the property names to something like sonar.gometalint.coverage.dtdVerification, sonar.gometalint.coverage.reportPath, &etc. Please don't choose a localization string like "go", which would be likely to cause further conflicts, unless you want to use it as another level, e.g. sonar.go.linter.coverage.dtdVerification.

The points above must be addressed before I can add you to the Marketplace. The points below are totally optional. Feel entirely free to stop reading now.

-------------------------

* your analysis logging is reeeally chatty. I got a whole bunch of these:

INFO: The key for the message could not import github.com/cockroachdb/cockroach/pkg/ccl (cannot find package "github.com/cockroachdb/cockroach/pkg/ccl" in any of: is null, issue will not be saved

and a whoooole bunch of these:

INFO: no coverage file in package /**/coverage.xml

and a bunch of these:

ERROR: Highlighting problem on save

* two of your rules are tagged with "check", which just seems odd to me. FWIW, there's no requirement for tagging on rules. It's fine for a rule to have 0 tags.

* several rules has reference links that are labeled just with the target domains. Ideally the user would have a more concrete idea of where she'll end up.

Ann

---

G. Ann Campbell | SonarSource

Product Manager

@GAnnCampbell

https://sonarsource.com

To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/b5d3e947-efbd-4d01-ab2f-f4161eb6ba39%40googlegroups.com.

[Daniel Le Berre]

Dear Ann,

We made that plugin because we use SonarQube for other languages and that there was no support for go.

The support from the community has been great so far. It has been a great experience for both Thibault and me.

Since SonarQube releases its own open source Go plugin, we are not going to continue to work on our own plugin.

It would not make sense.

We are just a bit sad to hear about it when we ask to be integrated to the marketplace.

An email from SonarQube explaining us the situation would have been appreciated.

Regards,

Daniel and Thibault

[Alexandre Gigleux]

Hello,

Actually, we contacted Thibault on his email at univ-artois.fr and you on your cril.fr email while we were starting to work on SonarGo. 

It's sad you never received it and you are just discovering we are working on SonarGo just today. I will forward it to you.

Regards

Alex

[Daniel Le Berre]

Hi Alex,

Thibault forwarded me your mail. [He actually found your original email in his spam box.]

My previous comment regarding the lack of contact with us is thus void :)

Thanks for informing us of you plans.

Regards,

Daniel