Static Code Analysis using SonarQube

SonarQube is a open source Quality Management Platform. Download SonarQube from http://www.sonarqube.org/downloads/ (Downloaded Zip file contains Web Server that comes with Embedded Database).

The best method to run the SonarQube platform is to set up the VM (preferabley Windows Server). Then install the SonarQube in the VM and run it there. Ensure that Firewall settings of the VM allows inbound connections.

Install SonarQube:
Unzip the downloaded .zip file and place them in your drive. If you want to configure different port, please edit sonar.properties file under /conf folder.

Run SonarQube:
Navigate to /SonarQube-5.1/bin/windows-x86-64/ folder and run startsonar.bat file. (It runs the WebServer at port number 9000).
Navigate to URL: http://localhost:9000

Analyze the code:
Install SonarQube Scanner:
SonarQube comes with separate tool for analyzing the source code. Download SonarQube Scanner (command line tool) from http://docs.sonarqube.org/display/SONAR/Installing+and+Configuring+SonarQube+Scanner

Unzip the zip file and place them in your drive.

Configure SonarQube Scanner:

Open /conf/sonar-runner.properties
Edit
#----- Default SonarQube server
sonar.host.url=http://vm-name:9000

Add the /bin directory to your path variable.

Open command prompt
type >sonar-runner -version

Run SonarQube Scanner:
Create a configuration file (sonar-project.properties) in the root directory of the java project. Specify project details, source code location (src folder path) and module names if the application has multiple modules (like web, service, common, etc).

Open command prompt. Navigate to the root directory of the java project. run >sonar-runner
This will run sonar analysis and push the analysis data to the sonarqube server's embedded database.

Navigate to the SonarQube URL and see the results in dashboard.

Note: If you want to use your own database such as oracle, MySQL, etc, please refer SonarQube Documentation for configuration steps.
If you want to run sonarqube analysis as part of Continuous Integration using Jenkins server, you can configure it in Jenkins server job.

Unit Tests Suceess report in SonarQube: SonarQube Scanner(Runner) can not execute the Unit test cases (Junit java classes), it can only analyze the testing reports. You have to run the Junit Test cases with maven or your preferred build tool (Note that running JUnit in Eclipse will not generate report) to generate the report. Then provide the report path in the sonar-project.properties. Then run the sonar analysis using SonarQube scanner. SonarQube runner uses the Java Plugin installed in SonarQube server to analyze the Junit report.

Sample configuration in Sonar-project.properties;

sonar.tests=src/test/java
#Tells SonarQube where the unit tests execution reports(Maven generated report) are 
sonar.junit.reportsPath=target/surefire-reports

Unit Test Code Coverage report in SonarQube: To collect the Unit Test Coverage, you need to launch JaCoCo tool along with your Maven build that runs Junit testcases.  Use this command: mvn clean org.jacoco:jacoco-maven-plugin:prepare-agent install -Dmaven.test.failure.ignore=true
Once you run the maven build with the above command, jacoco.exec file will be generated at folder /target/jacoco.exec

Now run the Sonar Runner with the following configuration in sonar-project.properties:

#Location of class files are required for java plugin(in SonarQube Server) to generate report out of jacoco.exec file
sonar.binaries=target/classes
#Tells SonarQube where the jacoco coverage data file(Maven generated file) are 
sonar.jacoco.reportsPath=target/jacoco.exec

Sample report at Sonar Dashboard: