imbi-plugin-sonarqube
SonarQube integration plugin for Imbi (Plugin Architecture v3).
The package ships a single SonarQubePlugin (slug sonarqube), discovered
by the imbi-common registry's imbi_plugin_* convention scan via the
module-level PLUGIN attribute. Its manifest declares:
- a
service_urlintegration-level option (the SonarQube base URL), - an
api_tokencredential (the integration's only credential) holding a SonarQube user token, and - one
webhook-actionscapability cataloging theupdate_project_from_webhookaction.
When a SonarQube webhook arrives at imbi-gateway and a matching
WebhookRule dispatches to sonarqube#update_project_from_webhook, the
handler:
- Reads the metric→JSONPointer mapping from
WebhookRule.handler_config. - Fetches
/api/measures/componentfrom SonarQube using the Integration's decryptedapi_tokencredential and itsservice_urloption. - Patches the matched Imbi project's facts.
Configuration
Operators create a SonarQube Integration, set its service_url option, and
store the SonarQube API token in the Integration's encrypted credentials.
The api_token must be a user token — created under My Account >
Security in SonarQube and prefixed squ_. SonarQube's analysis tokens,
sqa_ (global) and sqp_ (project), are restricted to the endpoints a
scanner uses and answer 403 to every request this plugin makes, including
/api/measures/component and the Project Doctor's component lookup. The
restriction rides on the token type, so issuing an analysis token from an
administrator account does not help. Grant the token's account Browse on the
projects being read, plus Create Projects if the Project Doctor should create
missing SonarQube projects.
A typical webhook rule:
Handler: sonarqube#update_project_from_webhook
Filter: /branch/is_main==true
Config: [
{"metric": "coverage", "path": "/test_coverage"},
{"metric": "ncloc", "path": "/lines_of_code"}
]
Metadata
Release files for imbi-plugin-sonarqube 2.39.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| imbi_plugin_sonarqube-2.39.0.tar.gz | 22.0 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| imbi_plugin_sonarqube-2.39.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 40.0 kB
Release files / imbi_plugin_sonarqube-2.39.0.tar.gz
| Download URL | imbi_plugin_sonarqube-2.39.0.tar.gz |
|---|---|
| Size | 22.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
25b0d2385c70756044282c8dcf00f8ddc5b247f009141f9844b4db0d9718f7b3
|
|
BLAKE2b-256 checksum How to use checksums |
d7b5ef815d27517a139375c5dfafedb016da669aaff85347687573eafdfc9cb8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logRelease files / imbi_plugin_sonarqube-2.39.0-py3-none-any.whl
| Download URL | imbi_plugin_sonarqube-2.39.0-py3-none-any.whl |
|---|---|
| Size | 18.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
133b2480b046cebe93d686badd5d51d1a8773289f286a11b21fbccdc70a1bf44
|
|
BLAKE2b-256 checksum How to use checksums |
2b4cf6213bf410286364674b1097db266e4a1fb549153a16a327b01eec5d7c50
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logSecurity for imbi-plugin-sonarqube 2.39.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for imbi_plugin_sonarqube-2.39.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
