Projects, Tokens, Scanners, Analysis Parameters, and First Analysis: Guided Hands-On Workflow

1. Disposable lab contract

Use local/private Community Build 26.9.0.129388 at http://127.0.0.1:9000, Scanner CLI 8.1.0.6389, project key academy-sonarqube-p06, and only synthetic source.

2. Create and freeze the source fixture

mkdir sonar-p06-lab && cd sonar-p06-lab
mkdir -p src
printf '%s
' 'def label_user(name, active):' '    if active == True:' '        message = "active:" + name' '    else:' '        message = "inactive:" + name' '    print(message)' '    return message' > src/app.py
printf '%s
' 'sonar.projectKey=academy-sonarqube-p06' 'sonar.projectName=Academy SonarQube Prompt 06 Lab' 'sonar.sources=src' 'sonar.sourceEncoding=UTF-8' > sonar-project.properties
git init
git add src/app.py sonar-project.properties
git -c user.name='Academy Lab' -c user.email='lab@example.invalid' commit -m 'baseline fixture'
git rev-parse HEAD

PowerShell users can create the same two files with Set-Content. Record the Git revision and whether the worktree is clean. Exact issue counts are intentionally not predicted because rules/profiles evolve; the indexed-file set and evidence chain are the stable checkpoint.

3. Create the disposable project

1. In the local UI choose Create Project → Local Project.
2. Key: academy-sonarqube-p06.
3. Name: Academy SonarQube Prompt 06 Lab.
4. Record the current default quality gate/profile names but do not customize policy yet.

Project creation establishes server identity/policy state. It does not analyze code.

4. Create and inject a project analysis token

At My Account → Security, generate a Project analysis token associated with this project. Copy it once and place it only in the current process environment.

export SONAR_HOST_URL='http://127.0.0.1:9000'
read -rsp 'Disposable project token: ' SONAR_TOKEN; echo
export SONAR_TOKEN

$env:SONAR_HOST_URL = 'http://127.0.0.1:9000'
$env:SONAR_TOKEN = Read-Host 'Disposable project token'

The PowerShell form is intentionally simple for a disposable local shell; do not print the value, write it to history, or reuse it. In real CI use the provider secret store. Environment variables are not perfect secret stores, but they avoid committing credentials and ordinary command-line token arguments.

5. Record scanner/runtime identity

Install the official platform distribution for Scanner CLI 8.1.0.6389, not a floating third-party package, then record:

sonar-scanner --version
java -version 2>&1 || true

Scanner Java and server Java are distinct. Current scanner JRE auto-provisioning should be recorded rather than assumed. If provisioning is disabled, verify the current Java requirement.

6. Predict before execution

• Source: src/app.py should be indexed under the fixed key.
• Client evidence: a scanner working directory and report-task.txt should appear after successful upload.
• Server evidence: a new CE task should exist and eventually reach a terminal status.
• Credential: revocation should invalidate later authentication without deleting the analysis.

7. Run the first analysis

sonar-scanner -Dsonar.host.url="$SONAR_HOST_URL"
cat .scannerwork/report-task.txt

Do not pass the token with -Dsonar.token=.... Preserve the first scanner output and the metadata file before rerunning. Verify that the log names the intended project key and indexes the expected fixture.

PowerShell: sonar-scanner '-Dsonar.host.url=http://127.0.0.1:9000', then Get-Content .scannerwork/report-task.txt.

8. Follow the exact Compute Engine task

CE_TASK_ID=$(awk -F= '$1=="ceTaskId"{print $2}' .scannerwork/report-task.txt)
printf 'ceTaskId=%s
' "$CE_TASK_ID"
curl --fail --silent -H "Authorization: Bearer $SONAR_TOKEN"   "$SONAR_HOST_URL/api/ce/task?id=$CE_TASK_ID"

Use the local UI Background Tasks page as an alternative. Poll conservatively until SUCCESS/FAILED/CANCELED. Preserve the first failure response before any retry. Verify endpoint permissions in the documentation embedded in the exact instance because Web API V2 is gradually replacing older endpoint families.

9. Verify the project result after CE success

1. Confirm project key/name.
2. Confirm the latest analysis belongs to this run.
3. Inspect Issues and Measures without assuming fixed counts.
4. Record the Quality Gate name and status.

curl --fail --silent -H "Authorization: Bearer $SONAR_TOKEN"   "$SONAR_HOST_URL/api/qualitygates/project_status?projectKey=academy-sonarqube-p06"

If the endpoint requires permissions the project token does not have on your exact release, do not widen that token. Use UI evidence or a separate least-privileged read/user token.

10. Revoke and prove cleanup

1. Revoke the project analysis token in My Account → Security.
2. Clear SONAR_TOKEN: unset SONAR_TOKEN or Remove-Item Env:SONAR_TOKEN.
3. Do not recover the raw token from history/logs merely to prove revocation. UI revocation metadata is valid evidence.
4. Refresh the project: the completed analysis should remain because credential state and persisted analysis state are independent.

11. Challenge: “scanner success, stale dashboard”

Before rerunning, inspect three things: the effective project key; the new ceTaskId and task status; and whether the report actually targeted the expected server. A stale dashboard can be project-identity drift, asynchronous processing, or an upload/server problem—not a reason for a blind retry.

Knowledge check

Official references and version notes

• SonarQube downloads — current Community Build and Server release identities.
• Managing your tokens — user, project-analysis, and global-analysis token semantics.
• Analysis-parameter configuration overview — precedence and persistence.
• Managing JRE auto-provisioning and scanner environment requirements.
• SonarScanner CLI 8.1.0.6389 and official scanner metadata.
• Web API — bearer authentication and the gradual Web API V2 transition.
• CI integration overview — asynchronous processing and quality-gate waiting.