Sonar-PMD is a plugin that provides coding rules from PMD for use in SonarQube.

Starting April 2022, the project has found a new home. We, jborgers and stokpop, aim to provide an active project and well-maintained sonar-pmd plugin. It is now sponsored by Rabobank.

For a list of all rules and their status, see: RULES.md

The plugin should be available in the SonarQube marketplace and is preferably installed from within SonarQube (Administration --> Marketplace --> Search pmd).

This plugin is available again from the Marketplace with the release of version 3.4.0. Alternatively, download the latest JAR file, put it into the plugin directory (./extensions/plugins) and restart SonarQube.

Usage should be straight forward:

1. Activate some PMD rules in your quality profile.
2. Run an analysis.

Sonar-PMD analyzes the given source code with the Java source version defined in your Gradle or Maven project. In case you are not using one of these build tools, or if that does not match the version you are using, set the sonar.java.source property to tell PMD which version of Java your source code complies to.

Possible values : 1.6 to 1.8/8 to 20-preview

(*1) Note: Plugin version 3.4.x runs in SonarQube 8.9, however, Java 17+ is only fully supported in SonarQube 9.3+.
(*2) Note: Tolerates Java 21, warns instead of breaks

A majority of the PMD rules have been rewritten in the Sonar Java plugin. Rewritten rules are marked "Deprecated" in the PMD plugin, but a concise summary of replaced rules is available.

PMD tool provides some rules that can check the code of JUnit tests. Please note that these rules (and only these rules) will be applied only on the test files of your project.

Sonar-PMD is licensed under the GNU Lesser General Public License, Version 3.0.

Parts of the rule descriptions displayed in SonarQube have been extracted from PMD and are licensed under a BSD-style license.

To build the plugin and run the integration tests:

./mvnw clean verify