Creating global analysis tokens in SonarQube Server

(music) Pulse Global analysis tokens offer a powerful, secure, and centralized way to manage automated code analysis on every project within a SonarQube Server instance. Let's get started! In this short video, you'll learn the purpose of SonarQube Server global analysis tokens, and how to generate one in SonarQube. This is a crucial step for setting up secure, automated analysis across all your projects. So what are global analysis tokens? They are secure credentials that let you run code analysis or use web services without your personal login. This is important because the token allows you to give limited access to a tool or pipeline and easily revoke it without compromising your main account. Let's go through how to create a global analysis token. First, you need to sign on to your SonarQube Server instance. Make sure your user account has the Global Execute Analysis permission— that's the key to making this token work. For a more secure option, we recommend using a dedicated Service Account whose only permission is Execute Analysis, following the principle of least priviledge. Once you've signed on, open your user Account settings, and navigate to the Security tab. This is where you'll manage all of your authentication tokens. Now, let's create the token. In the token Name field, give it a description, such as CI/CD-Pipeline-Global. This will help you easily identify its purpose later. Next, from the Type drop-down menu, select Global Analysis Token. This gives it the powerful permission to analyze any project in your instance. You can also set an expiration date for your token. When a token expires, all pipelines that rely on that token will stop working. While you have the option for No expiration, it’s always a best practice for security to set a clear expiration date. Then, click Generate. And here's the most important part— you must copy this token and save it in a secure location right now, like a password manager, or your CI/CD's secret store. This is the only time you will see this token value. Now that you've created a global analysis token, it’s ready to be used by your CI/CD workflows and SonarScanner analysis to securely communicate with SonarQube Server. Let’s take a quick look at where you’ll use the token when you run a SonarQube analysis from a build pipeline or an external tool. You'll typically store it as a secret within your DevOps platform, which can then be used within your CI/CD workflows. Never embed tokens directly in your scripts. So to recap: global analysis tokens are essential for securely automating your code quality analysis across all your SonarQube projects. They're perfect for centralized CI/CD, and integrating code quality checks directly into your workflow. See our additional videos to dive deeper into other Sonar topics! (chime)