SonarQube do not support Powershell language at present to analyze a Powershell code. There is no SonarQube PowerShell Plugin available as of now.
Please refer – https://www.sonarqube.org/features/multi-languages/
Alternative method is PSScriptSAnalyzer.
What is PSScriptSAnalyzer?
PSScriptAnalyzer is a static code checker for PowerShell modules and scripts. PSScriptAnalyzer checks the quality of PowerShell code by running a set of rules.
Please refer this – https://docs.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/overview?view=ps-modules
Can we integrate PSScriptSAnalyzer in SonarQube?
Yes. SonarQube plugins is a best way to integrate externals tools and functionality.
Refer – https://www.sonarplugins.com/ But i could not find any officual plugins for this. Later, based on more searches, i found 2 plugins which has been developed by community for the same integration.
- Plugin #1- https://github.com/gretard/sonar-ps-plugin
- Plugin #2- https://github.com/jairbubbles/sonar-powershell
Plugin #1 seems to be latest and updated code which we must try and see the integration.Plugin #1 is using PSScriptSAnalyzer only as a scan engine. Plugin #2 is writtern in 2016 and i feel that this has been obselete and need to be re-written.
Intro of sonar-ps-plugin
- Reporting of issues found by PSScriptAnalyzer
- Cyclomatic and cognitive complexity metrics (since version 0.3.0)
- Reporting number of lines of code and comment lines metrics (since version 0.3.2)
I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.
I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.
Find Trusted Cardiac Hospitals
Compare heart hospitals by city and services — all in one place.
Explore Hospitals
A practical concern that’s easy to underestimate is the long-term ownership burden of relying on community-maintained SonarQube plugins for PowerShell analysis. Before standardizing on
sonar-ps-plugin, teams should validate its compatibility with their SonarQube upgrade cadence, scanner versions, and CI runners because unsupported plugins can become blockers during platform upgrades. In many organizations, a more resilient pattern is to run PSScriptAnalyzer natively in Jenkins/GitHub Actions/Azure DevOps, export results as artifacts, and use SonarQube primarily for governance and quality gate reporting rather than making it the execution engine for PowerShell linting. This separation also makes it easier to tune rulesets, manage suppressions, and avoid noisy findings that eventually lead developers to ignore static analysis altogether.