Repository navigation
Add SonarQube plugin (external url source) - #58
Open
charafsalmi wants to merge 2 commits into
Open
charafsalmi wants to merge 2 commits into
charafsalmi wants to merge 2 commits into
Conversation
charafsalmi
marked this pull request as ready for review
October 20, 2026 14:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the official SonarQube plugin as a single marketplace entry. No files are vendored into this repo. The source is a
urlsource pointing at SonarSource/sonarqube-agent-plugins, pinned to a full commit SHA, in the same shape as the Dodo Payments entry in #54.What it gives Droid users. SonarQube checks code quality and security: bugs, vulnerabilities, leaked secrets and quality gates, across 40+ languages, on SonarQube Cloud or SonarQube Server. The plugin brings that into the Droid loop:
sonarCLI (sonar run mcp);sonar-*skills: analyze, list issues, fix an issue, quality gate, coverage, duplication, dependency risks and their triage, list projects, and setup;sonarqube-reviewerdroid with no edit tools, for review-only passes.It has no hooks. Users need the
sonarCLI, a container runtime, andsonar auth login(or thesonar-integrateskill, which walks through it).Packaging. The repository ships a native
.factory-plugin/plugin.jsonand adroids/directory, so Droid does not have to translate the Claude layout. Packaging and docs landed in SonarSource/sonarqube-agent-plugins#62.Checks I ran. With this branch added as a local marketplace,
droid plugin install sonarqube@<marketplace>(Droid 0.233.0) succeeds and resolves the pinned commit. The installed copy contains.factory-plugin/plugin.json(version 2.7.0),mcp.json, the ten skills anddroids/sonarqube-reviewer.md, and no hooks.marketplace.jsonparses.Pin. The SHA is the 2.7.0 release commit on
master(SonarSource/sonarqube-agent-plugins#61). Later releases will come as PRs moving the pin.I work at Sonar, on the team that maintains this plugin. Security policy: https://github.com/SonarSource/sonarqube-agent-plugins/blob/master/SECURITY.md.