Permissions
Permissions can be granted to groups or individual users. By default policy all projects are public. Anyone active Geant project participants logged user can browse and see the source code.
Project creation
Projects are created by development teams or people responsible for quality management on request.
Project creation is triggered by the CI: when the CI starts for the first time, it creates a matching project in SonarQube. The default name of the project in SonarQube is the name of the repository in Gitlab (it would be the same with Github).
The user creates his personal token in SonarQube and supplies the token in the CI, to authorize the job to connect to SonarQube. The token will be stored as masked variable in Gitlab (the user will decide to tore the token at project leve, or group level).
The CI makes use of the following Docker image: https://hub.docker.com/r/sonarsource/sonar-scanner-cli (there are other images available that can be tested) and its usage is documented here: https://docs.sonarqube.org/latest/analyzing-source-code/scanners/sonarscanner/
Other type of integrations are documented here: https://docs.sonarqube.org/latest/analyzing-source-code/ci-integration/overview/
Project deletion
Projects that have not been analyzed in the last 18 months will be automatically deleted without warning, unless the development or QA team needs to keep a specific project.