Creating project analysis tokens in SonarQube Server

(music) Pulse Project analysis tokens offer a powerful and secure way to manage automated code analysis on a single project within a SonarQube Server instance. Let's get started! In this short video, you'll learn the purpose of SonarQube Server project analysis tokens and how to generate one in SonarQube. So, what are project analysis tokens? Project analysis tokens are secure credentials that let your automated pipelines run code analysis. By limiting access to a single project, you can easily revoke it without impacting your main account or other projects. Now, let's create the token. First, sign on to your SonarQube Server instance using a service account or the CI account that will run the actual Sonar analysis. To create a project analysis token, the user should have Global Execute Analysis permission or Execute Analysis permission on the token's associated project. If the token's author loses Execute Analysis permissions for the associated project, the token will no longer be valid for performing an analysis. Once you've signed on, open your user account settings and navigate to the Security tab. This is where you'll manage all of your authentication tokens. Now, let's create the project analysis token. In the token Name field, give it a description, such as SonarQube-Project-CI/CD. This will help you easily identify its purpose later. Next, from the Type drop-down menu, select Project Analysis Token. select Project Analysis Token. Then, select the project you want to apply this token to from the Project drop-down menu. This will ensure it only has permission to analyze this specific project. You can also set an expiration date for your token. When the token expires, the pipeline that relies on it will stop working. While you have the option for No expiration, it’s always a best practice for security to set a clear expiration date. Then, click Generate. And here's the most important part! You must copy this token and save it in a secure location immediately, like a password manager or your DevOps platform secret store. This is the only time you will see this token value. Now that you've created a project analysis token, it's ready for your CI/CD workflows to use. Remember, for a secure SonarQube analysis, never embed tokens directly into your scripts. So, to recap, project analysis tokens are essential for secure and automated code quality analysis in SonarQube, providing granular control and improved security. See our additional videos to dive deeper into other Sonar topics.