dsh-sonarqube
用于 DeepSeek Harness 的只读 SonarQube Community Build 工具。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:maxmilian/dsh-sonarqube#0e42a1c8e23ec92ac8ff192cc5f5b325b9530510Sonarqube 以 dsh-sonarqube 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
dsh-sonarqube is a free, open-source, read-only DeepSeek Harness plugin for the
SonarQube Community Build Web API. It lets an agent inspect Quality Gates, issues,
Security Hotspots, coverage, duplication, and other project measures without changing
SonarQube state.
Issue and hotspot results include a normalized location object with the SonarQube
component key, source filePath, line, and text range when the API provides them.
| Tool | Purpose |
|---|---|
sonarqube_system_status | Read instance status and version. |
sonarqube_quality_gate | Read a project's Quality Gate for the main analysis, a branch, or a pull request. |
sonarqube_search_issues | Search issues by type, severity, status, branch, or pull request. |
sonarqube_search_hotspots | Search Security Hotspots by status, branch, or pull request. |
sonarqube_get_hotspot | Read the complete details for one Security Hotspot. |
sonarqube_get_measures | Read coverage, duplication, issue counts, hotspots, or caller-selected metrics. |
All tools are read-only. Version 0.1 does not assign, confirm, resolve, reopen, or otherwise modify issues or hotspots.
@deepseek-ai/dsh-tools APIsLive compatibility was manually validated on 2026-08-24 against SonarQube Community Build
26.8.0.126808 with SonarScanner CLI 8.0.1.6346. This does not imply compatibility with every
SonarQube release; verify the plugin against your own instance before relying on it in CI.
The live validation covered system status, Quality Gate, issue search with source-file and line
mapping, default measures, empty Security Hotspot search results, and safe hotspot 404 handling.
Community Build 26.8.0.126808 exposed no SECURITY_HOTSPOT rules, so a successful
sonarqube_get_hotspot response remains covered by mocked API tests rather than that live run.
Environment variables are recommended so credentials do not appear in a profile patch:
export SONARQUBE_URL='https://sonarqube.example.com'
export SONARQUBE_TOKEN='your-token'
Plugin config takes precedence over environment variables:
| Config | Environment fallback | Default |
|---|---|---|
baseUrl | SONARQUBE_URL | required |
token | SONARQUBE_TOKEN | required |
requestTimeoutMs | none | 30000 |
maxResponseBytes | none | 5242880 (5 MiB) |
Do not put token in cordis.patch.yml. If you need non-secret overrides, add a later profile
patch (later rows replace the row's whole config):
- id: dsh-sonarqube
name: dsh-sonarqube
config:
baseUrl: 'https://sonarqube.example.com'
requestTimeoutMs: 30000
maxResponseBytes: 5242880
The bundle included in this package mounts the plugin without credentials:
- insert:
- id: dsh-sonarqube
name: dsh-sonarqube
From a future npm release or a local tarball:
dsh plugin --profile web add dsh-sonarqube
dsh plugin --profile web add ./dsh-sonarqube-0.1.1.tgz
From GitHub source:
dsh plugin --profile web add github:maxmilian/dsh-sonarqube#PINNED_COMMIT
Git installs receive source rather than lib, so this package includes a prepare script that
builds with Bun. The profile installer may require explicit permission to run the dependency's
build script. Review the source, pin a commit, and allow the build only if you trust it.
Restart the selected DSH profile after installation. You can verify the composed layer without booting it:
dsh --profile web --dump-config
Ask the agent:
Use sonarqube_quality_gate for project acme-api on branch main.
Search open CRITICAL issues in acme-api, 50 per page.
Get coverage and duplicated_lines_density for acme-api.
Show the full Security Hotspot with key AX_example.
branch and pull_request are mutually exclusive. Search page sizes are bounded to 1..100, and
page × page_size must stay within the first 10,000 results. A measures request accepts at most 20
metric keys, each at most 100 characters. With no metric list it requests:
coverage, duplicated_lines_density, bugs, vulnerabilities, code_smells, security_hotspots
Schemastery configuration descriptions are localized for English, Traditional Chinese,
Simplified Chinese, and Japanese. The map includes DSH's current en and zh IDs plus common
regional IDs: en-US, zh-CN, zh-TW, ja, and ja-JP. A locale is selectable only when the
DSH host registers it; the current core UI ships en and zh.
The current @deepseek-ai/dsh-tools API accepts one model-facing description string per tool and
parameter, so those descriptions remain in English. This avoids claiming runtime localization that
DSH cannot currently consume. Repository documentation is available through the language links at
the top of each README.
Authorization: Bearer ... and never returns or logs the token.AbortSignal, a per-request timeout, and a maximum response size.Retry-After and SonarQube-Authentication-Token-Expiration metadata.SonarQube's Web API is gradually moving toward API v2. Endpoints are intentionally centralized in
src/client.ts, not spread across tool definitions, so future migrations stay localized.
This project uses Bun exclusively:
bun install --frozen-lockfile
bun run lint
bun run typecheck
bun run test --coverage
bun run build
bun pm pack
Tests use Vitest with mocked fetch; they do not require a live SonarQube server. Coverage gates
for lines, statements, functions, and branches are all set to at least 80%.
MIT