• Define a static analysis with SonarQube
• Define the default Quality Gate in SonarQube
• Convert the Quality Gate result into a JUnit and ship it to Xray

• code is available in GitHub

For this example, we will use SonarQube to assess the code quality and security level of the source code against a Quality Gate.

We will use Spring Pet Clinic open source code and introduce a security issue in it.

 We will need:

• Access to the Spring Pet Clinic github repository
• Access to a SonarQube instance to perform the static analysis
• Access to a Jira instance with Xray installed

$ docker run --rm \
    -p 9000:9000 \
    -v sonarqube_extensions:/opt/sonarqube/extensions \
    <image_name>

git clone https://github.com/spring-projects/spring-petclinic.git

mvn clean verify sonar:sonar \                                                                                                           
  -Dsonar.projectKey=PetShop \
  -Dsonar.projectName='PetShop' \
  -Dsonar.host.url=http://localhost:9000 \
  -Dsonar.token=<TOKEN>

The SonarQube analysis of the code was returning success, so we inserted a security liability to make it fail. In this case we have added the definition of a password in the code.

import requests
import base64
import logging
import datetime
import json
import jmespath
import sys, getopt

def generateJUnitXML(jsonContent):
  junitXML = '<?xml version="1.0" encoding="UTF-8" ?>\n'
  junitXML += '<testsuites>\n'
  junitXML += '  <testsuite name="ProjectMetrics" failures="' + str(len(jmespath.search("projectStatus.conditions[?status=='ERROR']", jsonContent))) + '" timestamp="' + datetime.datetime.now().isoformat() + '">\n'
  
  for condition in jsonContent['projectStatus']['conditions']:
    junitXML += '    <testcase name="' + condition['metricKey'] + '" status="' + condition['status'].lower() + '">\n'


    if condition['status'] == 'ERROR':
      junitXML += '      <failure message="Metric ' + condition['metricKey']+ " is " + condition['status'].lower() + '">\n'
      junitXML += '        Metric Key:'+ condition['metricKey']+ '\n'
      junitXML += '        Comparator:'+ condition['comparator']+'\n'
      junitXML += '        Error Threshold:'+ condition['errorThreshold']+'\n'
      junitXML += '        Actual Value:'+ condition['actualValue']+'\n'
      junitXML += '      </failure>\n'

    junitXML += '      <system-out>' + json.dumps(condition) + '</system-out>\n'
    junitXML += '    </testcase>\n'

  junitXML += '  </testsuite>\n'
  junitXML += '</testsuites>\n'

  return junitXML

def fetchData(authToken, endpoint):
  try:    
    #sqp_4f7646f293704964bb4dedcc67cfdf6ebd529a56
    #127.0.0.1:9000
    headers = {
      'Authorization': 'Basic ' + base64.b64encode(bytes(authToken +':','utf-8')).decode('utf-8') 
    }
    print('Fetching data from SonarQube')

    response = requests.get('http://'+ endpoint +'/api/qualitygates/project_status?projectKey=PetShop', headers=headers)

    print('Response: ' + response.text)
    jsonContent = response.json()

    # Process jsonContent and generate JUnit XML report
    junitXMLReport = generateJUnitXML(jsonContent)

    # Save the report to a file
    fs = open('junit.xml', 'w')
    fs.write(junitXMLReport)

    print(junitXMLReport)
  except Exception as error:
    logging.error('Error fetching data:', error)

def main(argv):
    try:
        opts, args = getopt.getopt(argv,"ha:e:",["afile=","efile="])
        for opt, arg in opts:
            if opt == '-h':
                print ('fetchDataSonarQube.py -a <AUTHORIZATION_TOKEN> -e <ENDPOINT>')
                sys.exit()
            elif opt in ("-a", "--afile"):
                authToken = arg
            elif opt in ("-e", "--efile"):
                endpoint = arg
    except Exception as err:
        print ("An exception occurred:", err)

    fetchData(authToken, endpoint)

if __name__ == "__main__":
   main(sys.argv[1:])efault function () {

<?xml version="1.0" encoding="UTF-8" ?>
<testsuites>
  <testsuite name="ProjectMetrics" failures="1" timestamp="2024-03-21T09:30:03.174683">
    <testcase name="new_coverage" status="ok">
      <system-out>{"status": "OK", "metricKey": "new_coverage", "comparator": "LT", "errorThreshold": "80", "actualValue": "100.0"}</system-out>
    </testcase>
    <testcase name="new_duplicated_lines_density" status="ok">
      <system-out>{"status": "OK", "metricKey": "new_duplicated_lines_density", "comparator": "GT", "errorThreshold": "3", "actualValue": "0.0"}</system-out>
    </testcase>
    <testcase name="new_violations" status="error">
      <failure message="Metric new_violations is error">
        Metric Key:new_violations
        Comparator:GT
        Error Threshold:0
        Actual Value:2
      </failure>
      <system-out>{"status": "ERROR", "metricKey": "new_violations", "comparator": "GT", "errorThreshold": "0", "actualValue": "2"}</system-out>
    </testcase>
  </testsuite>
</testsuites>

API

Once you have the report file available you can upload it to Xray through a request to the REST API endpoint. For that, the first step is to follow the instructions in v1 or v2 (depending on your usage) to obtain the token we will be using include authentication parameters in the subsequent following requests.

JUnit results

We will use

the API request

with the addition of some parameters that will set the Project to where the results will be uploaded and the Test Plan that will hold the Execution results.

In the first version of the API, the authentication used a login and password (not the token that is used in Cloud).

curl -H "Content-Type: text/xml" -X POST -H "Authorization: Bearer $token"  --data @"Junitmultipart/form-data" -u admin:admin -F "file=@Junit.xml" httpshttp://xray.cloud.getxray.app/api/v2/<YOUR_SERVER>/rest/raven/1.0/import/execution/junit?projectKey=XT

With this command we are creating a new Test Execution that will have the results of the Tests that were executed.

Once uploaded the Test Execution will look like the example below

Image RemovedImage Added

We can see that a new Test Execution was created with 3 Tests, one for each metric. The summary of each Test is extracted from the report.

In order to check the details we click on the details play icon next to each Test, that will expand a menu where we choose "Execution Details", this will take us to the Test Execution Details Screen

Image RemovedImage RemovedImage AddedImage Added

In the Test Execution details we have the following relevant information:

• Summary - Matches the measures defined in the SonarQube Quality Gate
• Execution Status - Indicates the overall status of the execution of the security tests.
• Context - Defined in the Python script to reflect the contained information.
• Output - Information on the measure for that context.

Bringing the information of security tests to your project will give you an overview of the entire testing process and bring that visibility up front for the team to have all the elements necessary to deliver quality products.