SonarSource have announced their own SonarQube Team Services / TFS integration

Microsoft have been partnering with SonarSource for almost two years to bring SonarQube to .NET developers and to make it easy to analyze MSBuild and Java projects from Visual Studio Team Services, TFS and Visual Studio. The partnership, and Team Services extensibility, have now matured to the point that we have jointly decided that it was time for Microsoft to transfer ownership of the SonarQube MSBuild build tasks to SonarSource. They are better placed to keep the tasks up to date and consistent with the SonarQube vision. SonarSource have now announced the availability of their own SonarQube Team Services and TFS extension on the VSTS marketplace.

Concretely what does it change for you?

In the past, we released the SonarQube Team Services build tasks “in the box”, so whenever we updated VSTS – every 3 weeks – we pushed updates to these tasks. The tasks were also shipped with the TFS on-premises product. The source code is in the vsts-tasks repository on GitHub along with the other tasks released by Microsoft. In future Microsoft’s SonarQube tasks won’t be released in the service or TFS product. Like many partners, SonarSource is now providing a dedicated SonarQube extension. This allows them to fully control the development and deployment of updates and fixes. Therefore, we are deprecating the MSBuild SonarQube tasks, and you will need to install the SonarQube extension to continue analyzing technical debt in your MSBuild projects.

What build tasks are affected?

The two tasks which are deprecated are the SonarQube for MSBuild tasks (SonarQube for ‘MSBuild – Begin Analysis’ and ‘SonarQube for MSBuild – End Analysis’).

Note that we also integrated SonarQube into the Java build tasks for Maven and Gradle in order to enable code analysis feedback in Pull Requests. These integrations will remain as they are for now, and will continue to be released by Microsoft. SonarSource may in the future provide a replacement build task or tasks for Java with this capability.

What will be the deprecation experience?

If you are a Team Services user, when you run a build that contains SonarQube for MSBuild tasks, you’ll notice some build warnings:

The warnings contain hyperlinks that will help you migrate.

Also, if you try to add the former tasks to a build definition, you’ll notice the [DEPRECATED] prefix in their label:

On the other hand, if you are working on-premises with TFS 2017, you’ll see these changes starting with TFS 2017 Update1.

Moving to the new tasks

At some point, the Microsoft-owned tasks will be deleted. We recommend switching to SonarSource’s extension as soon as possible. This is straight-forward – just install the SonarQube extension to your account and you’ll notice three new tasks in your library:

You‘ll recognize the last two, but the first is new: SonarSource is introducing a new task named “SonarQube Scanner CLI” that supports analysis of projects outside MSBuild and Java build technologies, a common request. You can now analyze your node.js projects, etc …

Minor breaking changes

SonarSource have taken the opportunity to address shortcomings in the old tasks and to action some of your feedback. Consequently, there are 2 small breaking changes:

• There is now a dedicated “SonarQube” endpoint instead of a generic one. This is an improvement, since you will now be able to find at a glance the service endpoints which are relevant to these tasks, without having to trawl through a long list of generic service end points.

You will be asked to input a token, which can be generated from your SonarQube dashboard.

The new endpoint will show up in the list of end points with a SonarQube icon, so that you can see it immediately.

• The database connection input fields are no longer available in the build step. This will only matter if you are using a version of SonarQube lower than 5.2. In that case, we advise you to upgrade your SonarQube server, or use the Additional Settings field to configure these parameters
  

Support

Moving forward, support is moving entirely to SonarSource, who would love to get your feedback. If you have questions or suggestions about the SonarQube build tasks, please use Google Groups with the SonarQube tag: https://groups.google.com/forum/#!forum/sonarqube