SonarQube를 이용한 소스코드 취약점 진단¶

#dockcer-compose.yml
services:
  sonarqube:
    image: sonarqube:community
    container_name: sonarqube
    depends_on:
      sonarqube-db:
        condition: service_healthy
    environment:
      SONAR_JDBC_URL: jdbc:postgresql://sonarqube-db:5432/sonar
      SONAR_JDBC_USERNAME: sonar
      SONAR_JDBC_PASSWORD: sonar_pass
      SONAR_ES_BOOTSTRAP_CHECKS_DISABLE: "true"   # 개발/로컬 환경용, 운영 시 제거
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions
      # 호스트 ./plugins 의 JAR를 컨테이너 플러그인 디렉터리에 마운트 (FindBugs 등)
      - ./plugins:/opt/sonarqube/extensions/plugins
      - sonarqube_logs:/opt/sonarqube/logs
    ports:
      - "9000:9000"
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    restart: unless-stopped
    networks:
      - sonarqube-net

  sonarqube-db:
    image: postgres:15
    container_name: sonarqube-db
    environment:
      POSTGRES_USER: sonar
      POSTGRES_PASSWORD: sonar_pass
      POSTGRES_DB: sonar
    volumes:
      - sonarqube_db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U sonar -d sonar"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - sonarqube-net

volumes:
  sonarqube_data:
  sonarqube_extensions:
  sonarqube_logs:
  sonarqube_db:

networks:
  sonarqube-net:
    driver: bridge

version: '3.8'

services:
  spring-boot-app:
    image: maven:3.9-eclipse-temurin-17
    container_name: spring-boot-dev
    working_dir: /app
    volumes:
      - ./:/app
      - maven-repo:/root/.m2
    ports:
      - "8080:8080"
      - "35729:35729"
    command: mvn spring-boot:run # Maven을 사용하여 Spring Boot 실행

volumes:
  maven-repo:
    name: spring-boot-maven-repo

#Spring 코드가 위치한 곳에서 컴파일 명령어 실행
mvn compile

mvn clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
  -Dsonar.projectKey=sonar_test \
  -Dsonar.projectName='sonar_test' \
  -Dsonar.host.url=http://192.168.0.1:9000 \
  -Dsonar.token={token}