SonarQube CLI

Use the installed sonar CLI as the source of truth for a SonarQube-enabled project. Prefer structured, read-only inspection before analysis or mutation, and make the final response state the project, branch or pull request, command scope, and result.

Start with a preflight

Run these checks from the repository or worktree the user placed in scope:

command -v sonar
sonar --version
sonar auth status

If the task involves installation state, integrations, or a confusing auth error, also run sonar system status --json.

Treat sonar auth status as the authoritative credential check. Do not infer authentication merely from a saved config file. In a sandbox, container, SSH session, or background agent, OS Keychain access may fail even though authentication works in the user's interactive terminal. Explain that distinction and use the environment-variable route in authentication.md when the user has made credentials available; never retrieve, print, or persist a token yourself.

The CLI is evolving. If the installed version differs from the reference snapshot or a command rejects an option, run sonar --help and sonar <command> --help, then follow the installed help. Read commands.md when selecting flags or when the user asks what the CLI supports.