SonarCloud Project Creator & Checker

This Azure DevOps extension automates the verification and creation of projects in SonarCloud. It ensures your CI/CD pipelines run smoothly by pre-configuring projects, Quality Gates, and New Code definitions before the analysis begins. This extension is designed to help with SonarCloud by providing a helper task. It's not an official SonarSource extension.

🚀 Why use this task?

Standard SonarCloud analysis often relies on projects being manually created or using default settings. This task provides:

• Auto-Provisioning: Creates the project if it doesn't exist.
• Standardization: Automatically applies the correct Quality Gate and "New Code" definition.
• Smart Verification: Can be used just to check if a project exists without creating it.
• Idempotent: Reads the current configuration and only applies what differs. Safe to run on every pipeline execution.
• Dry run: Preview the changes without creating or modifying anything.
• SCM agnostic: Works with Azure Repos, GitHub, GitLab, Bitbucket, etc.

🛠️ Recommended Usage

Place this task before the Prepare Analysis Configuration task from SonarSource. This ensures the environment is perfectly configured when the scanner starts.

- task: sonarcloud-create-project@1
  inputs:
    SonarCloud: 'MySonarConnection'
    sonarOrganization: 'my-org-key'
    serviceKey: 'my-project-key'
    serviceName: 'My Project Name'
    createProject: 'true'

Full example

- task: sonarcloud-create-project@1
  name: sonarSetup
  inputs:
    SonarCloud: 'MySonarConnection'
    sonarOrganization: 'my-org-key'
    serviceKey: 'my-project-key'          # optional: defaults to <organization>_<repository name>
    serviceName: 'My Project Name'
    createProject: 'true'
    visibility: 'private'
    mainBranch: 'main'
    tags: 'backend,node'
    long_live_branches: '(main|release/.*)'
    sonarQualityGate: 'Company way'       # id or name
    additionalSettings: |
      sonar.exclusions=**/test/**,**/*.spec.ts
      sonar.coverage.exclusions=**/migrations/**
    qualityProfiles: |
      ts=Company way
      js=Company way
    permissionTemplate: 'Default template' # applied only when the project is created
    groupPermissions: |
      developers=user,codeviewer
      leads=issueadmin,securityhotspotadmin
    failOnConfigError: true

- script: echo "Project $(sonarSetup.SonarProjectKey) created now: $(sonarSetup.SonarProjectCreated)"

---

⚙️ Input Configuration

Core Settings

Input Label	Parameter Name	Required	Description
SonarCloud Service Connection	SonarCloud	Yes	The Azure DevOps Service Connection for SonarCloud.
Organization	sonarOrganization	Yes	Select or enter the SonarCloud organization key.
Project keyname	serviceKey	No	Unique identifier for the project (e.g., front-angular). If empty, it is derived as <organization>_<repository name> from Build.Repository.Name.
Project name	serviceName	No	Human-readable name displayed in SonarCloud.
Create project	createProject	Yes	Yes to create if missing; No to only check existence.

Project Customization (Visible when Create Project = Yes)

Input Label	Parameter Name	Required	Description
Main Branch Name	mainBranch	No	Default branch name (e.g., trunk, release).
Visibility	visibility	Yes	Project visibility used on creation: private or public.
Enforce visibility on existing projects	enforceVisibility	No	Also update the visibility of projects that already exist. Default false.
Tags	tags	No	Comma-separated tags (e.g., dev,node,aws).
Long-lived branches (regex)	long_live_branches	No	Regex for long-lived branches (e.g., (master|qa)).
Select the quality gate	sonarQualityGate	No	Quality Gate to assign to the project, by id or name.

New Code Definition (Advanced)

Found under the Code Definition Options group. Visible when createProject is enabled.

Input Label	Parameter Name	Type	Description
Configure New Code Definition	enableNewCodeDefinition	boolean	Enables the "New Code" configuration group.
New Code Definition Type	newCodeDefinitionType	radio	previous_version, days, date, or version.
New Code Definition Value	newCodeDefinitionValue	string	Required if type is NOT previous_version. days: positive integer, date: YYYY-MM-DD, version: version string.

Advanced Configuration

Input Label	Parameter Name	Description
Additional settings	additionalSettings	One key=value per line with any project setting (e.g. sonar.exclusions, sonar.cpd.exclusions). Multi-value settings accept comma-separated values. Explicit inputs (long-lived branches, new code) take precedence.
Quality profiles	qualityProfiles	One language=Profile name per line (language keys: js, ts, java, cs, py, ...).
Permission template	permissionTemplate	Template applied only when the project is created by the task.
Group permissions	groupPermissions	One group=perm1,perm2 per line. Permissions: admin, codeviewer, issueadmin, securityhotspotadmin, scan, user. Only missing permissions are granted.
User permissions	userPermissions	One login=perm1,perm2 per line. Same permissions as above.

Execution Options

Input Label	Parameter Name	Description
Dry run	dryRun	Logs the changes that would be applied without creating or modifying anything.
Fail on configuration errors	failOnConfigError	Fails the task if any configuration step fails. By default the task ends as Succeeded with issues.

Output variables

Name	Description
SonarProjectKey	Key of the project (useful when it is derived from the repository name).
SonarProjectUrl	URL of the project overview.
SonarProjectExists	true if the project existed before the task ran.
SonarProjectCreated	true if the project was created by this task.

---

🖼️ Preview

General Setup

Detailed Inputs

---

💻 Technical Requirements

• Runtime: Compatible with agents running Node 20 or Node 24.
• Permissions: The token used in the Service Connection must have "Administer Projects" permissions in SonarCloud (and "Create Projects" to create them).
• Regions: The URL of the service connection is used, so both https://sonarcloud.io and the US region https://sonarqube.us are supported.
• Web API v2: The Quality Gate is associated through the Web API v2 (api.sonarcloud.io / api.sonarqube.us), since the v1 api/qualitygates/* endpoints are deprecated since September 2025. If the v2 API is not reachable, the task falls back to v1.
• Resilience: API calls use a 30s timeout and retry with exponential backoff on network errors, HTTP 429 and 5xx.