SonarJava
SonarJava inspects Java code for bugs, vulnerabilities, and maintainability issues, then explains why each finding matters and how to fix it. Information about the analysis of Java features is available here.
This repository contains the analyzer source used by SonarQube Server, SonarQube Cloud, and SonarQube for IDE. SonarJava applies the same analysis to developer-written and AI-generated code, giving teams a consistent way to verify changes before they reach production.
Learn more about Java analysis on the Sonar website.
Features
- 600+ rules (including 150+ bug detection rules and 350+ code smells)
- Metrics (cognitive complexity, number of lines, etc.)
- Import of test coverage reports
- Custom rules
Use SonarJava
SonarJava runs through SonarQube Server, SonarQube Cloud, and SonarQube for IDE. Read the Java analysis documentation for setup and coverage guidance.
Useful links
Have questions or feedback?
To provide feedback (request a feature, report a bug, etc.) use the Sonar Community Forum. Please do not forget to specify the language (Java!), plugin version and SonarQube Server version.
If you have a question on how to use plugin (and the docs don't help you), we also encourage you to use the community forum.
Contributing
Topic in Sonar Community Forum
To request a new feature, please create a new thread in Sonar Community Forum. Even if you plan to implement it yourself and submit it back to the community, please start a new thread first to be sure that we can use it.
Pull Request (PR)
To submit a contribution, create a pull request for this repository. Please make sure that you follow our code style and all tests are passing (all checks must be green).
Custom Rules
If you have an idea for a rule but you are not sure that everyone needs it you can implement a custom rule available only for you. Note that in order to help you, we highly recommend to first follow the Custom Rules 101 tutorial before diving directly into implementing rules from scratch.
Work with us
Would you like to work on this project full-time? We are hiring! Check out https://www.sonarsource.com/hiring
Testing
To run tests locally follow these instructions.
Java versions
You need Java 26 to compile and run the Unit Tests of the project and Java 21 run most Integration Tests (ITs).
Note that Java 21 can be used to build and test all modules except under java-checks-test-sources (as they require Java 26).
If you are adding or moving rule test samples, see java-checks-test-sources/README.md
for guidance on when samples belong in the dedicated test-source modules instead of java-checks/src/test/files.
Build the Project and Run Unit Tests
To build the plugin and run its unit tests, execute this command from the project's root directory:
mvn clean install
Note that
Running unit tests within the IDE might incur in some issues because of the way the project is built with Maven.
If you see something like this:
java.lang.SecurityException: class ... signer information does not match signer information of other classes in the same package
try removing the Maven nature of the 'jdt' module.
Integration Tests
To run integration tests, you will need to create a properties file like the one shown below, and set the URL pointing to its location in an environment variable named ORCHESTRATOR_CONFIG_URL.
# version of SonarQube Server
sonar.runtimeVersion=LATEST_RELEASE
orchestrator.updateCenterUrl=http://update.sonarsource.org/update-center-dev.properties
This is the beginning of the README. Read the rest at the original. Read the full README ↗
