---
updatedAt: 2026-07-29T14:27:30.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/governance/llms.txt
---

# Sonar Evidence Integration

Convert SonarQube scan attestations into signed evidence using JFrog CLI.

The Evidence Collection service can convert Sonar attestations generated by SonarQube into [JFrog evidence](/docs/evidence-service-cli). All forms of evidence subjects are supported, including artifacts, packages, builds, and Release Bundles. The following [`jf evd create`](/docs/create-evidence-cli) command shows a sample Sonar integration:

```shell
jf evd create --build-name <build-name> --build-number <build-number> --integration sonar --key <path-to-key> --key-alias <key-alias>
```

Where:

* `<build-name>`: The name of the build associated with the Sonar scan
* `<build-number>`: The build number associated with the Sonar scan
* `<path-to-key>`: Path to the private key used to sign the evidence
* `<key-alias>`: The alias of the public key used to verify the evidence

For example:

```shell
jf evd create --build-name my-app-build --build-number 42 --integration sonar --key ./private.pem --key-alias sonar-signing-key
```

## Prerequisites

* `SONAR_TOKEN` or `SONARQUBE_TOKEN` environment variable for fetching the data from Sonar
* `report-task.txt` which contains the output of the Sonar code scan. These are the default locations for this file.

| Type    | Default Location                        |
| ------- | --------------------------------------- |
| maven   | `target/sonar/report-task.txt`          |
| gradle  | `build/sonar/report-task.txt`           |
| cli     | `.scannerwork/report-task.txt`          |
| msbuild | `.sonarqube/out/.sonar/report-task.txt` |

## Configuration Options

You can use either environment variables or a YAML file to set configuration options for Sonar evidence. The YAML file, named `evidence.yml` or `evidence.yaml`, is looked up in a `.jfrog/evidence/` folder found by searching upward from the current directory. If none is found, JFrog CLI falls back to its home directory (`~/.jfrog/evidence/`).

| Environment variable              | YAML parameter           | Description                                                                                                        |
| :-------------------------------- | :----------------------- | :----------------------------------------------------------------------------------------------------------------- |
| `SONAR_URL`                       | `url`                    | The Sonar URL. When the URL cannot be resolved from report-task.txt, the default value is `https://sonarcloud.io`. |
| `SONAR_REPORT_TASK_FILE`          | `reportTaskFile`         | The location of the output produced by Sonar. Default locations are described in the Prerequisites section.        |
| `SONAR_POLLING_MAX_RETRIES`       | `pollingMaxRetries`      | The maximum number of calls to the Sonar server to retrieve the report-task.txt file.                              |
| `SONAR_POLLING_RETRY_INTERVAL_MS` | `pollingRetryIntervalMs` | The interval in milliseconds between polling attempts.                                                             |

## Sample evidence.yml/evidence.yaml file

```yaml
sonar:
  url: https://sonarcloud.io
  reportTaskFile: /path/to/report-task.txt
  pollingMaxRetries: 30
  pollingRetryIntervalMs: 5000
```

<Callout icon="📘" theme="info">
  **Note**

  Environment variables override the values defined in `evidence.yaml`.
</Callout>

<br />

## Related Topics

* [Create Evidence CLI - Sample Commands](/docs/create-evidence-cli-sample-commands)
* [Generate Evidence Key Pair CLI](/docs/generate-evidence-key-pair-cli)
* [Get Evidence CLI](/docs/get-evidence-cli)