Add possibility to export sonarqube reports

[LvffY]

Describe the solution you'd like

I'm pretty sure that sonarqube is used by almost every users that use kics.

For now, Sonarqube doesn't support the SARIF reports. May be kics could add a new output report style that follows sonarqube generic issue import format that will allow users to import kics analysis into sonarqube as any other static code analysis.

Describe alternatives you've considered

• May be a complete Sonarqube plugin about SARIF reports could be considered
• May be a simple way to transform SARIF reports in sonarqube generic issue import format could be useful and more easy to produce. You would just add another integration section in your docs.

[joaoReigota1]

Hello @LvffY
We will add a new report style that will be in json and be named sonarqube.
Regarding the structure, this is how it will look

{
    "issues": [
        {
            "engineId": "KICS v1.x.x",
            "ruleId": "<Query ID>: <Query Name>",
            "severity": "<CRITICAL, MAJOR, MINOR, INFO>",
            "type": "<VULNERABILITY, CODE_SMELL>",
            "primaryLocation": {
                "message": "<Query Description>: <Query Expected Value>",
                "filePath": "<File path>",
                "textRange": {
                    "startLine": 1
                }
            },
            "secondaryLocations": [
                "<All Other Query Ocurrences>"
            ]
        }
    ]
}

[LvffY]

Hello @joaoReigota1

That would be great !