---
sourceDocument: Xanadu IT Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-service-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# SonarQube

# SonarQube integration with DevOps Change Velocity {#ariaid-title1}

* Release version: Xanadu
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Connect to your SonarQube instance that is integrated with your CI/CD pipelines to retrieve code quality and code security results.

## SonarQube integration overview {#sonarqube-devops-integration-devops__section_fzf_jqg_bqb}

Sonar scans that are configured on GitHub Actions, Jenkins, and Azure DevOps pipelines are
supported in DevOps Change Velocity. Both SonarCloud and SonarQube
(on-premises) are supported.

You can view the code quality and code security summary results either in the related list of
a Change Request or the Task Execution of the pipeline in your ServiceNow
instance. You can also use code quality and code security results in defining change policies
and conditions for change automation.

DevOps Change Velocity captures both overall and new code metrics.

## Get started {#sonarqube-devops-integration-devops__section_p1d_cj1_fwb}

You can onboard your Sonar instance using an admin or a non-admin Sonar user.

Pre-requisite configuration for admin user

:   In SonarQube: Project-level access to your SonarQube
    instance to configure scans for all your projects.

Pre-requisite configuration for non-admin users
:
    * In SonarQube:
      * The non-admin user must have access to a branch created using Branch Analysis. For more information, see [Branch Analysis](https://docs.sonarqube.org/latest/analyzing-source-code/branches/branch-analysis/).
      * The non-admin user must have Browse and Execute Analysis permissions for the projects (both private and public) for which you want to run and view scan results.

      {#sonarqube-devops-integration-devops__ul_prz_gj1_fwb}  
      Note:  
      You can set up branch analysis to enable SonarCloud to analyze branches in your projects apart from the main branch. You can't set up or perform branch analysis on SonarQube community edition licenses. Upgrade to SonarQube Developer or Enterprise editions to set up branch analysis on SonarQube on-premises implementations.
    * In DevOps Change Velocity
      1. Navigate to AllDevOpsAdministrationProperties.
      2. Enable the DevOps Non-Admin Software Quality Summary Flag property by selecting the Yes option.
      {#sonarqube-devops-integration-devops__ol_nr4_mj1_fwb}
    {#sonarqube-devops-integration-devops__ul_bqc_1mp_gwb}

Sonar custom action and extension are available in the GitHub and Azure DevOps marketplace
respectively. For Jenkins, the Sonar scan results are retrieved using ServiceNow
Jenkins plugin.

For more information on the scan results captured in ServiceNow, see [Software Quality Results](https://www.servicenow.com/docs/T2ffPxbp9GvrVla49p3VwQ#dev-ops-software-quality-results "Software Quality Results display scan details from SonarQube scans configured on your GitHub Actions, Jenkins, Azure DevOps, or Harness pipelines.").

Use one of the following options to onboard SonarQube. For a guided experience, use the workspace to onboard a tool. Alternatively, you can use the Service Catalog or Classic experience.
* **[Onboard SonarQube to DevOps Change Velocity --- Workspace](https://www.servicenow.com/docs/xzhiXS1fLJPnzeAw_u4Zug)**   
  Connect to your Sonar instance using the DevOps Change Workspace playbook.
* **[Onboard SonarQube to DevOps Change Velocity --- Service Catalog](https://www.servicenow.com/docs/QHY987DKw15MDRclUPv1vw)**   
  Connect your Sonar instance using the ServiceNow Service Catalog.
* **[Onboard SonarQube to DevOps Change Velocity --- Classic](https://www.servicenow.com/docs/mL1v5QrscLfpdmhLiMs4JQ)**   
  Connect to your Sonar instance to retrieve scan results.

*[\>]: and then