/
Enabling SonarCloud Analysis on an OpenMRS Repository

Enabling SonarCloud Analysis on an OpenMRS Repository

OpenMRS utilizes SonarCloud (formerly known as SonarQube Cloud) to automatically scan pull requests for bugs, vulnerabilities, security issues, and code smells. Once it's enabled on a repository, the Sonar bot analyzes every PR and posts a summary comment directly on the pull request, like the one below:

 

image-20260526-112231.png

You don't need to make any changes to the GitHub repository itself to turn this on. It is all configured from the SonarCloud side.

Prerequisites

Before you start, make sure you have:

  • A SonarQube Cloud (SonarCloud) account, signed in with your GitHub account.

  • The Create Projects permission in the OpenMRS organization on SonarCloud. This is required to import a repository, and an organization admin grants it. If you don't have it yet, request it from an admin before continuing.

How to enable SonarCloud on a repository

  • Open the OpenMRS organization on SonarCloud: https://sonarcloud.io/organizations/openmrs/projects

    Screenshot from 2026-05-26 16-56-02-20260526-112602.png

  • Start a new analysis. Select the ➕ (plus) icon at the top right, then choose Analyze new project.

    Screenshot from 2026-05-26 16-59-41-20260526-112941.png

  • Select the organization. Pick OpenMRS as the organization.

  • Choose the repository. Search for and select the repository (or repositories) you want to enable analysis on. Once you make a selection, the Set up button appears.

    Screenshot from 2026-05-26 17-00-26-20260526-113026.png

  • Click Set up.

  • Confirm the project settings. Choose the new code definition for the project (this controls which code the Quality Gate evaluates), then select Create project.

That's it. SonarCloud analysis is now enabled on the repository.

What happens next

  • SonarCloud automatically analyzes the repository's default branch (usually main) and the most recently active pull requests.

  • From then on, analysis runs automatically whenever someone pushes to the default branch or to a pull request branch.

  • For each PR, the Sonar bot posts its analysis summary as a comment, and the result feeds into the Quality Gate so you can see whether the new code meets the bar before merging.

Troubleshooting

  • The "Analyze new project" option is missing, or the repo isn't listed: You likely don't have the Create Projects permission, or the repository hasn't been made visible to the SonarCloud GitHub app. Reach out to an OpenMRS organization admin.

  • No PR comment appears: Confirm the project was created successfully and that the pull request targets a branch that SonarCloud analyzes (the default branch or another PR branch).

References