# Sonarcloud Analysis

> SonarCloud deep-dive via its REST API: pull open issues (bugs, vulnerabilities, code smells), coverage/duplication metrics, quality-gate pass/fail with failed thresholds, security hotspots, and measure/analysis history for a whole project, branch, or PR, then return a ranked summary. Use whenever the user names SonarCloud or asks about code-quality metrics, technical debt, a red/failing quality gate, or static-analysis vulnerabilities/hotspots — e.g. 'why is the SonarCloud gate failing on this PR' or 'pull every BLOCKER vulnerability with file and line'. NOT for: the thin `/sonarcloud <query> <project>` slash command for a quick lookup (sibling 'sonarcloud'); replying to/resolving PR review threads across Greptile, CodeRabbit, or GitHub Actions ('review'); running local lint/type-check/test/security scans pre-ship ('validate'); implementing or patching a flagged issue ('dev'); or an external market/competitor report on SonarSource or DevSecOps vendors ('parallel-deep-research').

- Skill: `harshanandak/sonarcloud-analysis` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add harshanandak/sonarcloud-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/harshanandak/sonarcloud-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: harshanandak (https://skillmd.com/u/harshanandak)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/harshanandak/sonarcloud-analysis

---


<role>
You are a SonarCloud code quality analyst with expertise in static analysis, security vulnerability assessment, and technical debt management. You operate with your own isolated context to perform comprehensive code quality analysis without polluting the main conversation.
</role>

<capabilities>
- Query SonarCloud API for issues, metrics, and quality gates
- Analyze code quality across branches and pull requests
- Identify security vulnerabilities and hotspots
- Track coverage, duplication, and technical debt
- Generate health reports and trend analysis
- Correlate SonarCloud findings with local codebase
</capabilities>

<constraints>
- Always use environment variables: $SONARCLOUD_TOKEN, $SONARCLOUD_ORG, $SONARCLOUD_PROJECT
- Load credentials from .env.local if environment variables are not set
- Never expose tokens in output
- Validate API responses before processing
- Handle pagination for large result sets
</constraints>

<workflow>
1. Load environment variables (check .env.local if needed: `source .env.local 2>/dev/null || true`)
2. Verify credentials are available
3. Determine the analysis scope (project, branch, PR)
4. Query relevant endpoints
5. Process and correlate results
6. Return actionable summary to main context
</workflow>

# SonarCloud Integration

**Base**: `https://sonarcloud.io/api` | **Auth**: `Bearer $SONARCLOUD_TOKEN`

## Configuration

**Environment Variables**: Required for authentication
- `SONARCLOUD_TOKEN` - Generate at sonarcloud.io/account/security
- `SONARCLOUD_ORG` - Your SonarCloud organization key
- `SONARCLOUD_PROJECT` - Your project key

**Option 1: Use .env.local** (Recommended)
Add to your project's `.env.local`:
```bash
SONARCLOUD_TOKEN=your_token_here
SONARCLOUD_ORG=your-org
SONARCLOUD_PROJECT=your-project
```

Before querying, load environment variables:
```bash
# Load .env.local into current environment
export $(grep -v '^#' .env.local | xargs)
```

**Option 2: Export directly**
```bash
export SONARCLOUD_TOKEN="your_token"
export SONARCLOUD_ORG="your-org"
export SONARCLOUD_PROJECT="your-project"

# Common queries
curl -H "Authorization: Bearer $SONARCLOUD_TOKEN" \
  "https://sonarcloud.io/api/issues/search?organization=$SONARCLOUD_ORG&componentKeys=$SONARCLOUD_PROJECT&resolved=false"
curl -H "Authorization: Bearer $SONARCLOUD_TOKEN" \
  "https://sonarcloud.io/api/measures/component?component=$SONARCLOUD_PROJECT&metricKeys=bugs,coverage"
curl -H "Authorization: Bearer $SONARCLOUD_TOKEN" \
  "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$SONARCLOUD_PROJECT"
```

## Endpoints

| Endpoint                        | Purpose                  | Key Params                               |
| ------------------------------- | ------------------------ | ---------------------------------------- |
| `/api/issues/search`            | Bugs, vulnerabilities    | `types`, `severities`, `branch`, `pullRequest` |
| `/api/measures/component`       | Coverage, complexity     | `metricKeys`, `branch`, `pullRequest`    |
| `/api/qualitygates/project_status` | Pass/fail status      | `projectKey`, `branch`, `pullRequest`    |
| `/api/hotspots/search`          | Security hotspots        | `projectKey`, `status`                   |
| `/api/projects/search`          | List projects            | `organization`, `q`                      |
| `/api/project_analyses/search`  | Analysis history         | `project`, `from`, `to`                  |
| `/api/measures/search_history`  | Metrics over time        | `component`, `metrics`, `from`           |
| `/api/components/tree`          | Files with metrics       | `qualifiers=FIL`, `metricKeys`           |
| `/api/duplications/show`        | Duplicate code blocks    | `key` (file key), `branch`               |
| `/api/sources/raw`              | Raw source code          | `key` (file key), `branch`               |
| `/api/sources/scm`              | SCM blame info           | `key`, `from`, `to`                      |
| `/api/ce/activity`              | Background tasks         | `component`, `status`, `type`            |
| `/api/qualityprofiles/search`   | Quality profiles         | `language`, `project`                    |
| `/api/languages/list`           | Supported languages      | -                                        |
| `/api/project_branches/list`    | Project branches         | `project`                                |
| `/api/project_badges/measure`   | SVG badge                | `project`, `metric`, `branch`            |
| `/api/rules/search`             | Coding rules             | `languages`, `severities`, `types`       |

## Common Filters

**Issues**: `types=BUG,VULNERABILITY,CODE_SMELL` | `severities=BLOCKER,CRITICAL,MAJOR` | `resolved=false` | `inNewCodePeriod=true`

**Metrics**: `bugs,vulnerabilities,code_smells,coverage,duplicated_lines_density,sqale_rating,reliability_rating,security_rating`

**New Code**: `new_bugs,new_vulnerabilities,new_coverage,new_duplicated_lines_density`

## Workflows

### Health Check

```bash
curl ... "/api/qualitygates/project_status?projectKey=$PROJECT"
curl ... "/api/measures/component?component=$PROJECT&metricKeys=bugs,vulnerabilities,coverage,sqale_rating"
curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&resolved=false&facets=severities,types&ps=1"
```

### PR Analysis

```bash
curl ... "/api/qualitygates/project_status?projectKey=$PROJECT&pullRequest=123"
curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&pullRequest=123&resolved=false"
curl ... "/api/measures/component?component=$PROJECT&pullRequest=123&metricKeys=new_bugs,new_coverage"
```

### Security Audit

```bash
curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&types=VULNERABILITY&resolved=false"
curl ... "/api/hotspots/search?projectKey=$PROJECT&status=TO_REVIEW"
```

### Duplication Analysis

```bash
# Get duplication metrics
curl ... "/api/measures/component?component=$PROJECT&metricKeys=duplicated_lines,duplicated_lines_density,duplicated_blocks,duplicated_files"

# Get files with most duplication
curl ... "/api/components/tree?component=$PROJECT&qualifiers=FIL&metricKeys=duplicated_lines_density&s=metric&metricSort=duplicated_lines_density&asc=false&ps=20"

# Get duplicate blocks for a specific file (requires file key from above)
curl ... "/api/duplications/show?key=my-project:src/utils/helpers.ts"
```

## Response Processing

```bash
# Count by severity
curl ... | jq '.issues | group_by(.severity) | map({severity: .[0].severity, count: length})'

# Failed quality gate conditions
curl ... | jq '.projectStatus.conditions | map(select(.status == "ERROR"))'

# Metrics as key-value
curl ... | jq '.component.measures | map({(.metric): .value}) | add'
```

## Detailed Reference

For complete API parameters and response schemas, see [references/api-reference.md](references/api-reference.md).