Pull requests are an essential part of the software development process. They allow developers to propose changes to a codebase and to review and discuss those changes before merging them into the main branch. However, reviewing pull requests manually can be time-consuming, error-prone, and may miss some critical issues.

SonarCloud is a cloud-based code analysis tool that can help automate the code review process, providing automated code quality analysis, code coverage, and security testing. In this blog post, we will discuss how to use SonarCloud to analyze pull requests and ensure that code changes meet the expected code quality standards.

Setting up SonarCloud

Before analyzing pull requests, we need to set up SonarCloud for our project. First, we need to create an account on the SonarCloud website and create a new project. Once the project is created, we need to configure the project settings and specify the programming language, test coverage reports, and quality gate rules.

To use SonarCloud in our project, we need to install SonarScanner, a command-line tool that analyzes the source code and sends the results to SonarCloud. We also need to generate a token for our project and configure the SonarScanner to use that token. We can add this step in. Our CI pipeline which publishes the code qaulity on Sonar .

Analyzing Pull Requests

To analyze pull requests with SonarCloud, we need to configure the SonarScanner to use the pull request key and branch name. We can use the following command to retrieve the pull request number from Github and pass it to the SonarScanner:

SONAR_TOKEN=XXXXXXXXXX
SHA_COMMIT=XXXXXXXXXXX

export PR_NUMBER=$(git ls-remote |grep '$SHA_COMMIT'|awk '/refs\/pull\/.*\/./{split($2,a,"/");print a[3]}') 

echo "PR Number: $PR_NUMBER" 

#Run Sonar Scanner on PR
sonar-scanner -Dsonar.host.url=https://sonarcloud.io \
-Dsonar.organization=TEST_PROJECT \
-Dproject.settings=sonar-project.properties \
-Dsonar.projectBaseDir=. \
-Dsonar.go.coverage.reportPaths=coverage.out  \
-Dsonar.qualitygate.wait=true \
-Dsonar.verbose=False \
#This Parameter must will pass for PR analysis 
-Dsonar.pullrequest.key=$PR_NUMBER \
-Dsonar.pullrequest.branch=<PRBranchName> \
-Dsonar.pullrequest.base=<MainBranchFromwherePRCreated>

In the above command, we first export the pull request number from Github by using the git ls-remote command and filtering the result using grep. -Dsonar.go.coverage.reportPaths=coverage.out, which specifies the location of the code coverage report file. This command assumes that you are using the Go programming language, but you can modify it based on the language you are using. Once you have generated the code coverage report file, you can pass the file path to the parameter.

We then pass the pull request number to the SonarScanner using the sonar.pullrequest.key parameter. We also specify the branch name and base branch using the sonar.pullrequest.branch and sonar.pullrequest.base parameters.

Sonar Offical Doc: Link

Publishing Results on SonarCloud and Github

Once we run the SonarScanner command, SonarCloud will analyze the code changes and generate a report. We can view the report on the SonarCloud website and see the analysis results, including code quality, code coverage, and security issues.

Once your report publishing on Sonar, you can see the Sonar report on Pull request.

We can also configure SonarCloud to integrate with GitHub and automatically update the pull request status based on the analysis results. To do this, we need to configure the SonarCloud Github app and enable the SonarCloud Github action.

Conclusion Analyzing pull requests with SonarCloud can help ensure that code changes meet the expected quality standards and prevent potential issues from being introduced into the codebase. By automating the code review process, developers can save time and focus on other critical aspects of software development. With SonarCloud, developers can analyze their code changes quickly and efficiently and ensure that their code meets the expected quality standard.

Thanks for reading the blog, Please share valuable feedback if you have any.

Reference : Pull request analysis