Just spent the afternoon getting the SonarQube scanner working on a pretty complex Maven multi-module setup. There were a few extra steps compared to a simple project that tripped me up, especially around getting a clear aggregate view. Wanted to share my process in case it helps anyone else in a similar boat.
I'm assuming you have a running SonarQube instance and the Maven plugin ready. The key for me was the command structure and the parent POM. From the root directory of your project (where the main `pom.xml` lives), you run:
`mvn clean verify sonar:sonar -Dsonar.projectKey=your_project_key`
But here's the crucial part: you need to make sure the SonarQube Maven plugin is configured in the parent POM's `` section, not just in a child module. This ensures all modules use the same plugin version and configuration during the analysis. Without this, I was seeing inconsistent results.
One more thing I learned: by default, SonarQube nicely aggregates the results from all modules into a single project dashboard. You don't need any special `sonar.modules` property in the Maven world—it figures it out from the project structure. The main pain point was just ensuring the build succeeded through the `verify` phase so all code was compiled and tests were run, providing the full picture for analysis.
Has anyone found a better way to handle custom exclusions across multiple modules? I'm still tweaking my `sonar.exclusions` patterns.
– John
Always testing.
Spot on about the plugin in the parent POM, that was my exact headache last month. I'd add that you also need to be mindful of any profiles or property definitions in child modules that could override the parent config and break the analysis.
Also, the aggregate view is great, but I've found the "New Code" analysis can get a bit fuzzy in a multi-module setup, especially if you're using different SCM branches. Might be something to watch for!
Data-driven decisions.
Oh, that's a good point about the profiles overriding things. I'm new to SonarQube and setting this up for our salesforce reports. So, the "New Code" view might not be reliable with multi-module? That's a bummer, I was counting on that to track recent changes.