Rules, Rule Types, Severities, Quality Profiles, and Customization: Guided Hands-On Workflow

1. Preflight and safety boundaries

Use only the private/local Community Build server from earlier chapters. Scanner execution uses a project-analysis token; profile changes use an interactive account with Administer Quality Profiles permission. Do not scan with an administrator token.

export SONAR_HOST_URL='http://127.0.0.1:9000'
sonar-scanner --version
git --version
curl -fsS "$SONAR_HOST_URL/api/system/status" || true

2. Create the disposable fixture

rm -rf sonar-p09
mkdir -p sonar-p09/src sonar-p09/tests
cd sonar-p09
git init
git config user.name 'Academy Learner'
git config user.email 'learner@example.invalid'
cat > src/routing.py <<'PYCODE'
def route(score, premium, active):
    if active:
        if premium:
            if score > 80:
                return "priority"
            return "premium"
        if score > 50:
            return "standard-plus"
    return "standard"
PYCODE
cat > tests/test_routing.py <<'PYTEST'
from src.routing import route

def test_route():
    assert route(90, True, True) == "priority"
PYTEST
cat > sonar-project.properties <<'PROPS'
sonar.projectKey=academy-sonarqube-p09
sonar.projectName=Academy SonarQube P09 Rule Policy Lab
sonar.sources=src
sonar.tests=tests
sonar.sourceEncoding=UTF-8
PROPS
git add . && git commit -m 'p09 controlled rule fixture'
git rev-parse HEAD | tee revision.txt

The function is deliberately below the normal Python S3776 default threshold of 15 but complex enough to cross a much smaller experimental threshold. Record the actual complexity reported by your installed analyzer rather than assuming it.

3. Inspect current policy before mutation

1. Record Administration → Configuration → Mode; do not switch it.
2. In Rules, filter Python and retrieve python:S3776.
3. Record its repository/key, status, tags, current mode-specific classification and configurable threshold. Current guidance uses 15 as the Python default; the installed analyzer is authoritative.
4. In Quality Profiles → Python, record Sonar way's BUILT-IN/DEFAULT status and active/deprecated counts.
5. In the disposable project's Quality Profiles settings, record the current Python profile.

4. Baseline scan

read -rsp 'Project-analysis token: ' SONAR_TOKEN; echo
export SONAR_TOKEN
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee baseline-debug.log
cp .scannerwork/report-task.txt baseline-report-task.txt
grep -E '^(ceTaskId|dashboardUrl|serverUrl|projectKey)=' baseline-report-task.txt

Wait for the referenced Compute Engine task to finish. Record the S3776 issue search and Quality Gate separately. Scanner success, CE success and gate status are three distinct states.

5. Extend Sonar way and associate only the lab project

1. Quality Profiles → Python → Sonar way → Extend.
2. Name the child Academy Python Guardrails.
3. Verify Sonar way is the parent and rules are inherited.
4. Do not set it as the Python default.
5. Associate only academy-sonarqube-p09 with the child.

Prediction 1: project-policy state changes while source revision, scanner binary and indexed files stay unchanged. Verify the association independently before changing a rule.

6. Change one inherited parameter

1. Open the child profile's active rule list and retrieve python:S3776.
2. Record the inherited threshold and current mode classification.
3. Select Change and set only the Cognitive Complexity threshold to 3.
4. Leave severity/impact, the Quality Gate and all other rules unchanged.
5. Confirm the rule is now shown as overridden.

Prediction 2: the child effective rule configuration changes; Sonar way remains unchanged. If the current analyzer rejects 3, use the smallest valid positive threshold below the measured fixture complexity and record the deviation.

7. Reanalyze the exact same revision

test -z "$(git status --porcelain)" || { git status --short; exit 1; }
git rev-parse HEAD | tee revision-overridden.txt
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee overridden-debug.log
cp .scannerwork/report-task.txt overridden-report-task.txt

After CE success, filter Issues by python:S3776. Expected evidence is a new cognitive-complexity issue caused by the stricter child threshold. Because the revision is unchanged, the profile override is the causal variable. Preserve the issue's actual measured complexity and allowed threshold.

8. Revert to parent definition

1. Return to S3776 in the child profile.
2. Select Revert to Parent Definition.
3. Keep the project associated with the child for one restore scan so only one variable changes.

sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee restored-debug.log
cp .scannerwork/report-task.txt restored-report-task.txt

Verify that the override marker is gone and the stricter-threshold issue is no longer newly raised under parent policy. Preserve history rather than deleting it.

9. Required evidence

10. Cleanup

1. Revoke the project-analysis token and unset SONAR_TOKEN.
2. Remove the explicit project/profile association after rollback evidence is complete.
3. Delete the child profile only after proving no project uses it and preserving its backup/change record.
4. Delete the lab project/fixture only after evidence is copied.
5. Leave Sonar way, language defaults, shared caches and server/database/search state untouched.

11. Challenge: choose the correct layer

A teammate wants to loosen the Quality Gate because threshold 3 produces a new maintainability issue. Explain why that changes the wrong layer: this experiment is evaluating a rule parameter in a quality profile. Gate changes alter downstream pass/fail policy and would confound the policy experiment.

Knowledge check

Official references and version notes

• Community Build — SonarQube rules — repositories, statuses, rule categories, custom/template rules and mode-dependent severity semantics.
• Community Build — Instance mode overview, including MQR Mode and Standard Experience.
• Community Build — Understanding quality profiles — built-in/default profiles, inheritance, overrides and project association.
• Community Build — Creating a quality profile — Extend, Copy, blank creation and import/export.
• Community Build — Editing a custom quality profile — activate/deactivate rules, customize parameters and Revert to Parent Definition.
• Community Build — Associating a quality profile with projects.
• Sonar Rules — Python S3776 — Cognitive Complexity rule used in the controlled parameter experiment.
• SonarQube releases — current Community Build and Server release identities.