SonarQube Setup

Connecting SonarQube lets FlightDesk surface code quality issues and security hotspots directly on each task. When issues are found, the review prompt tells Claude Code exactly what to fix.

Prerequisites

• A SonarQube Cloud account or self-hosted SonarQube server
• A SonarQube project already configured for your repository
• Admin access to configure webhooks in SonarQube

Step 1: Generate a SonarQube Token

In SonarQube:

1. Click your avatar → My Account
2. Go to the Security tab
3. Under "Generate Tokens", enter a name (e.g. "FlightDesk") and click Generate
4. Copy the token — you won't be able to see it again

The token needs at least Browse permission on the projects you want to connect.

Step 2: Connect in FlightDesk

SonarQube is configured per project, not per organization — each project points at its own SonarQube project.

1. Open the project and go to Project Settings → Integrations
2. Switch SonarQube on, then click Configure
3. Fill in:
   • SonarQube Host URL — https://sonarcloud.io, or your self-hosted URL
   • Project Key — the SonarQube project key
   • API Token — the token from step 1, stored encrypted
4. Save

If SonarQube is not listed yet, add it from the available integrations at the bottom of the same section. The API Token is a password field and is stored encrypted.

Step 3: Run the Scanner in CI

There is no webhook to configure. FlightDesk reads SonarQube's verdict from the GitHub check run that SonarCloud already posts on the pull request, and fetches the issue details from SonarQube's API using the token from Step 2. Both halves work as soon as the scan runs — nothing else to wire up.

SonarQube still needs to be triggered by your CI pipeline. Add a scan step that runs on pull requests.

Example for GitHub Actions with SonarCloud:

- name: SonarCloud Scan
  uses: SonarSource/sonarcloud-github-action@master
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Make sure your sonar-project.properties has the correct sonar.projectKey and sonar.organization.

How the Integration Works End-to-End

1. PR opens → your CI runs a SonarQube scan
2. SonarCloud posts its result as a check run on the GitHub pull request
3. GitHub notifies FlightDesk, which creates or updates a SonarQube check on the task
4. The check shows issue counts; issues appear in the Review Prompt
5. Claude Code reads the issues via FlightDesk's proxy — a live call to SonarQube's API, so it sees full issue detail rather than a summary — makes fixes, and pushes
6. CI re-triggers the scan on the new push
7. SonarCloud posts an updated check run → the check refreshes in FlightDesk

Check States

| State | Meaning | |---|---| | Passed | Zero issues, zero security hotspots | | Pending | Issues found — details in the review prompt | | Failed | Security hotspots present — these require human review |

Security hotspots are flagged as Failed rather than Pending because they require a human judgment call, not just an automated fix.

SonarQube Cloud Free Tier

SonarCloud is free for all public repositories. Private repository support is available on paid plans. Self-hosted SonarQube Community Edition is free with no feature restrictions for this integration.