SonarQube Setup

Connecting SonarQube lets FlightDesk surface code quality issues and security hotspots directly on each task. When issues are found, the review prompt tells Claude Code exactly what to fix.

Prerequisites

• A SonarQube Cloud account or self-hosted SonarQube server
• A SonarQube project already configured for your repository
• Admin access to configure webhooks in SonarQube

Step 1: Generate a SonarQube Token

In SonarQube:

1. Click your avatar → My Account
2. Go to the Security tab
3. Under "Generate Tokens", enter a name (e.g. "FlightDesk") and click Generate
4. Copy the token — you won't be able to see it again

The token needs at least Browse permission on the projects you want to connect.

Step 2: Connect in FlightDesk

1. Go to Settings → Organization → Integrations
2. Find SonarQube and click Configure
3. Enter your SonarQube URL (e.g. https://sonarcloud.io or your self-hosted URL) and the token
4. Click Save

FlightDesk will test the connection immediately and surface an error if the credentials are invalid.

Step 3: Configure the Webhook in SonarQube

FlightDesk needs SonarQube to push results when a scan completes.

In your SonarQube project:

1. Go to Project Settings → Webhooks
2. Click Create
3. Set the URL to https://api.flightdesk.dev/webhooks/sonarqube
4. Set the Secret to your organization's webhook secret (find it on the FlightDesk integrations page)
5. Click Create

For SonarCloud, webhooks can also be set at the organization level under Administration → Webhooks.

Step 4: Run the Scanner in CI

FlightDesk receives results via webhook — but SonarQube still needs to be triggered by your CI pipeline. Add a scan step that runs on pull requests.

Example for GitHub Actions with SonarCloud:

- name: SonarCloud Scan
  uses: SonarSource/sonarcloud-github-action@master
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Make sure your sonar-project.properties has the correct sonar.projectKey and sonar.organization.

How the Integration Works End-to-End

1. PR opens → your CI runs a SonarQube scan
2. SonarQube sends results to the FlightDesk webhook
3. FlightDesk creates or updates a SonarQube check on the task
4. The check shows issue counts; issues appear in the Review Prompt
5. Claude Code reads the issues via FlightDesk's proxy, makes fixes, and pushes
6. CI re-triggers the scan on the new push
7. SonarQube sends updated results → check refreshes in FlightDesk

Check States

| State | Meaning | |---|---| | Passed | Zero issues, zero security hotspots | | Pending | Issues found — details in the review prompt | | Failed | Security hotspots present — these require human review |

Security hotspots are flagged as Failed rather than Pending because they require a human judgment call, not just an automated fix.

SonarQube Cloud Free Tier

SonarCloud is free for all public repositories. Private repository support is available on paid plans. Self-hosted SonarQube Community Edition is free with no feature restrictions for this integration.