Docs / Observability and data
SonarQube
Connect your own SonarQube instance to read Quality Gates, issues, vulnerabilities and Security Hotspots.
The SonarQube connector lets the agent read analysis results from your SonarQube server through a Pangea proxy. It does not upload or scan source code. It reads results that SonarQube already has.
Connect
1. Create a user token
On your SonarQube instance, open My Account → Security and create a User token. Use a dedicated service user that only has read access to the projects you want the agent to review. An analysis token does not cover all Web API reads.
2. Connect in Pangea
As a team Administrator, open Connectors → Connect → SonarQube and fill in:
| Field | Notes |
|---|---|
| Label | A short name, for example security or staging |
| SonarQube URL | The public base URL of your instance, for example https://sonarqube.example.com |
| User token | The token you created, usually starting with squ_ |
Click Connect. Pangea validates the token against your instance and stores it encrypted on its servers.
Your server must be reachable from Pangea over the internet. Pangea refuses localhost, .local and .svc hosts, and any URL that resolves to a private, loopback or reserved IP address.
Use and verify
Select the connection in a conversation and ask for one project's latest completed analysis and Quality Gate. The agent can read:
- Quality Gate status
- code issues and vulnerability findings
- Security Hotspots
- measures and completed analyses
Check the analysis date and branch before you treat a finding as true for the current code. A new result only appears after SonarQube runs a new analysis.
This connector does not give access to your repositories. To change code, the agent uses a source-control connector such as GitHub.
Permissions
Team Administrators connect and remove this connection. They can limit who uses it with a member allow-list.
Troubleshooting and removal
If the instance is unreachable, check that its URL is public and that it answers from the internet. If a project is missing, check the service user's project access. Don't upgrade the token to an administrator just to get past a missing read permission.
To end access, remove the connection and revoke the token in SonarQube.
See SonarQube token management.