imbi-plugin-sonarqube
SonarQube integration plugin for Imbi (Plugin Architecture v3).
The package ships a single SonarQubePlugin (slug sonarqube), discovered
by the imbi-common registry's imbi_plugin_* convention scan via the
module-level PLUGIN attribute. Its manifest declares:
- a
service_urlintegration-level option (the SonarQube base URL), - an
api_tokencredential (the integration's only credential) holding a SonarQube user token, and - one
webhook-actionscapability cataloging theupdate_project_from_webhookaction.
When a SonarQube webhook arrives at imbi-gateway and a matching
WebhookRule dispatches to sonarqube#update_project_from_webhook, the
handler:
- Reads the metric→JSONPointer mapping from
WebhookRule.handler_config. - Fetches
/api/measures/componentfrom SonarQube using the Integration's decryptedapi_tokencredential and itsservice_urloption. - Patches the matched Imbi project's facts.
Configuration
Operators create a SonarQube Integration, set its service_url option, and
store the SonarQube API token in the Integration's encrypted credentials.
The api_token must be a user token — created under My Account >
Security in SonarQube and prefixed squ_. SonarQube's analysis tokens,
sqa_ (global) and sqp_ (project), are restricted to the endpoints a
scanner uses and answer 403 to every request this plugin makes, including
/api/measures/component and the Project Doctor's component lookup. The
restriction rides on the token type, so issuing an analysis token from an
administrator account does not help. Grant the token's account Browse on the
projects being read, plus Create Projects if the Project Doctor should create
missing SonarQube projects.
A typical webhook rule:
Handler: sonarqube#update_project_from_webhook
Filter: /branch/is_main==true
Config: [
{"metric": "coverage", "path": "/test_coverage"},
{"metric": "ncloc", "path": "/lines_of_code"}
]
Release files for imbi-plugin-sonarqube 2.36.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| imbi_plugin_sonarqube-2.36.0.tar.gz | 22.0 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| imbi_plugin_sonarqube-2.36.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 40.0 kB
Release files / imbi_plugin_sonarqube-2.36.0.tar.gz
| Download URL | imbi_plugin_sonarqube-2.36.0.tar.gz |
|---|---|
| Size | 22.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
53458f27232fcf8bd226fb35da29370eeccdd0e03c86f34facf3d067753de696
|
|
BLAKE2b-256 checksum How to use checksums |
c47764de46978c1ba2ba0c50b5b5afe47edb744b71c81982977436c2ec0aab1b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 23, 2026.
Transparency logRelease files / imbi_plugin_sonarqube-2.36.0-py3-none-any.whl
| Download URL | imbi_plugin_sonarqube-2.36.0-py3-none-any.whl |
|---|---|
| Size | 18.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
23487f226bcf67dc2c1e24df6cb9feae8d196ee9670c93fc241b3ec0146fc6f5
|
|
BLAKE2b-256 checksum How to use checksums |
3af0b2b33590163f17fe67cd5d8d544d277a46ee82e5a251dde3a6d8924d51cf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 23, 2026.
Transparency log
