Skip to main content
Use a SonarQube webhook to send the quality gate result of every code analysis to Flashduty On-call. Each branch (or pull request) of each project maps to one Flashduty alert: it triggers when the quality gate fails (ERROR) and recovers automatically when the gate passes (OK) on the same branch. It works with SonarQube Server (Community Build, Developer, Enterprise, Data Center) and SonarQube Cloud, which send the same webhook body.

In Flashduty On-call

You can get the push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channels and open a channel
  2. Go to Settings → Integrations → Dedicated integrations and click Add integration
  3. Select SonarQube and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select SonarQube and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In SonarQube

1

Create the webhook in SonarQube

Where: SonarQube Server › Administration › Configuration › Webhooks › CreateSystem administrator required. This webhook applies to every project. To limit it to one project, create it under your project › Project Settings › Webhooks › Create instead (project administrator required, up to 10 per project).
SonarQube has no separate recovery setting: when the next analysis of the same project and branch passes the quality gate (OK), Flashduty recovers the alert automatically.
2

Run an analysis and verify

Where: The CI pipeline that runs sonar-scanner
  1. Run an analysis of the project from CI (for example sonar-scanner). SonarQube posts the webhook when the analysis finishes
  2. Make the quality gate fail (for example by raising a coverage threshold temporarily) and confirm an alert appears in Flashduty
  3. Fix it, run another analysis, and confirm the alert recovers once the gate passes
SonarQube has no test button for webhooks, so you cannot send a test event from the console; verify with a real analysis. On SonarQube Server, the Last delivery column of Administration › Configuration › Webhooks shows the result of each delivery. A delivery that gets no response within 10 seconds is marked failed, and SonarQube does not retry it.

Alert key

The Alert Key is computed from the project key (project.key), the branch type (branch.type, such as BRANCH or PULL_REQUEST), and the branch name (branch.name). As a result:
  • A failure and a later pass on the same branch of the same project share one Alert Key, so the alert recovers when the gate passes
  • Different branches, pull requests, and projects never affect each other’s alerts
  • Changes to the project name, quality gate name, analysis ID, or commit do not change the Alert Key
  • Analyses without branch information (editions without branch analysis) are told apart by project key alone
A request without project.key is rejected.

Status and severity

SonarQube webhooks carry no severity, and a failed quality gate is a code quality signal rather than an outage, so every alert is Warning. Adjust it with routing or alert management in Flashduty if needed. These deliveries are ignored, and Flashduty returns success: failed or cancelled analyses (status is FAILED or CANCELLED, no quality gate), bodies without qualityGate, and any other qualityGate.status value. Every passing analysis sends an OK; it is used only to recover the active alert of the same project and branch.

Labels

The alert description lists each failed condition with its metric, current value, and threshold.

Troubleshooting

  • Flashduty returns an invalid parameter error: check that the URL is complete and includes integration_key
  • No alert arrives: confirm the analysis produced a quality gate result. On SonarQube Server, check the status code under Last delivery on the Webhooks page; SonarQube Cloud needs a paid plan
  • The alert does not recover: recovery depends on the next analysis of the same project and branch. After a pull request is closed there are no further analyses, so close its alert manually
  • SonarQube Server cannot reach Flashduty: the webhook is sent by the SonarQube server itself; make sure it has outbound internet access or a configured proxy
For field details, see SonarQube Webhooks.