The `sonarqube-scanner` package provides a Node.js-based client to initiate code analysis on SonarQube Server and SonarCloud for JavaScript, TypeScript, and other compatible projects. Unlike the Java-based SonarScanner CLI, this module does not require a Java Runtime Environment, streamlining integration into JavaScript-centric build pipelines. The current stable version is 4.3.6, with frequent releases primarily focused on dependency updates, minor bug fixes, and security patches. It offers both a command-line interface (via `npx @sonar/scan` or global installation) and a programmatic API for integration into Node.js applications. Key differentiators include its lightweight nature for Node.js environments and direct support for `sonar.projectKey`, `sonar.sources`, and other SonarQube analysis properties.
npm install sonarqube-scannerVerified import paths — ran on the pinned version, not inferred.
This TypeScript example demonstrates how to programmatically trigger a SonarQube analysis for a project, configuring common properties like project key, sources, tests, and coverage reports. It uses environment variables for sensitive data.
Upgrade your Node.js runtime to version 18 or higher. If unable to upgrade, use a compatible older version of `sonarqube-scanner` (e.g., v3.x for Node 16+).
When installing via npm, use `npm install sonarqube-scanner`. When importing programmatically, use `import scanner from 'sonarqube-scanner';`. For `npx` or global CLI usage, follow the project's specific instructions, which currently point to `npx @sonar/scan` or the `sonar` command for global installations.
Upgrade `sonarqube-scanner` to version 4.3.0 or higher to mitigate these security risks. Regularly update dependencies to benefit from ongoing security patches.
Do not solely rely on the callback for pipeline success/failure. Implement additional steps to query the SonarQube/SonarCloud API for the project's quality gate status after the scan has been submitted.
Upgrade your Node.js environment to version 18 or newer (e.g., `nvm install 18 && nvm use 18`).
Verify the `serverUrl` option in your scanner configuration. Ensure the SonarQube server is running and accessible from the machine initiating the scan. Check firewall rules or proxy settings.
Install the package globally using `npm install -g sonarqube-scanner` or use `npx sonarqube-scanner` instead to run it without global installation.