Checkpoint Lab — Projects, Tokens, Scanners, Analysis Parameters, and First Analysis

1. Checkpoint charter

Analyze sonar-p06-lab against local Community Build 26.9.0.129388 using Scanner CLI 8.1.0.6389, project key academy-sonarqube-p06, and a newly generated project analysis token. Follow the analysis into the exact CE task and gate, then revoke the token.

2. Exact assumptions

3. Predictions before the run

1. src/app.py is the intended indexed source.
2. Successful upload creates fresh report-task.txt and a new ceTaskId.
3. After CE SUCCESS, the existing project receives a new analysis and gate evaluation.
4. Revoking the token blocks future use but leaves that analysis durable.

4. Preflight

cd sonar-p06-lab
git status --short
REVISION=$(git rev-parse HEAD)
printf 'revision=%s
' "$REVISION"
cat sonar-project.properties
sonar-scanner --version
curl --fail --silent http://127.0.0.1:9000/api/server/version

Verify the project key/name in the UI. If missing, recreate the disposable project with the exact key; do not silently alter repository identity to match an accidental project.

5. Create the checkpoint token

Generate a new project analysis token. Record only its label, type, associated project, issuer, expiry/lifetime choice, generation time, and later revocation time. Never place the raw value in the evidence packet.

6. Execute and preserve client evidence

export SONAR_HOST_URL='http://127.0.0.1:9000'
read -rsp 'Disposable project token: ' SONAR_TOKEN; echo
export SONAR_TOKEN
sonar-scanner -Dsonar.host.url="$SONAR_HOST_URL" | tee scanner-run.log
cp .scannerwork/report-task.txt report-task.checkpoint.txt
cat report-task.checkpoint.txt

Before storing/sharing logs, search for token material and environment dumps. Do not enable debug unless normal evidence is insufficient and explicit redaction controls are in place.

7. Follow the exact server task

CE_TASK_ID=$(awk -F= '$1=="ceTaskId"{print $2}' report-task.checkpoint.txt)
curl --fail --silent -H "Authorization: Bearer $SONAR_TOKEN"   "$SONAR_HOST_URL/api/ce/task?id=$CE_TASK_ID" > ce-task.json

If PENDING/IN_PROGRESS, query again after a short interval. If FAILED, stop the success checklist, preserve the terminal response, and apply Lesson 4 before rerun.

8. Verify measures/issues/gate after CE success

1. Confirm project identity and newest analysis context.
2. Record Issues and Measures without asserting a fixed count.
3. Record gate name and status.
4. Use an API response only if the current token has documented permission; otherwise use UI evidence or a separate governed read token.

curl --fail --silent -H "Authorization: Bearer $SONAR_TOKEN"   "$SONAR_HOST_URL/api/qualitygates/project_status?projectKey=academy-sonarqube-p06"   > quality-gate.json

9. Revoke and prove final credential state

1. Revoke the checkpoint token in My Account → Security.
2. Record the revocation timestamp.
3. Clear SONAR_TOKEN from the process environment.
4. Do not retrieve the raw token from logs/history merely to test it; the UI revocation record is valid evidence.
5. Refresh the project and verify the completed analysis remains.

Desired final state: analysis durable; credential invalid.

10. Required evidence packet

11. Claims and limitations

This proves: the recorded synthetic revision and effective inputs were accepted by the chosen scanner/server path; the report was processed; the recorded project/gate result existed; and the disposable token was revoked.

It does not prove: every language/build is configured correctly, branch/PR analysis or provider decoration works, security analysis is exhaustive, CI policy is correct, or production HA/backup/upgrade operations are ready. Those need later chapter evidence.

12. Guarded cleanup

1. Ensure token revocation and environment cleanup.
2. Keep the disposable project if later lessons will reuse it; otherwise delete only academy-sonarqube-p06 using supported project controls after verifying the key.
3. Remove the local synthetic repository only after preserving the sanitized evidence packet.
4. Never delete SonarQube database/search volumes or global server state as project-level cleanup.

Knowledge check

Official references and version notes

• SonarQube downloads — current Community Build and Server release identities.
• Managing your tokens — user, project-analysis, and global-analysis token semantics.
• Analysis-parameter configuration overview — precedence and persistence.
• Managing JRE auto-provisioning and scanner environment requirements.
• SonarScanner CLI 8.1.0.6389 and official scanner metadata.
• Web API — bearer authentication and the gradual Web API V2 transition.
• CI integration overview — asynchronous processing and quality-gate waiting.