Create Code Analysis with SonarCloud

SonarCloud is available for free here: https://github.com/apps/sonarcloud

Someone with access to the OWASP org needs to configure it for us.

Once it's configured we need to;

1. Create a user authentication token for the account on SonarCloud.
   2. Encrypt this token travis encrypt abcdef0123456789 --pro
2. Before pushing get the OWASP organisation key for SonarCloud
3. Create a sonar-project.properties file with the following lines;

sonar-project.properties
# must be unique in a given SonarQube instance
sonar.projectKey=<owaspSecurityShepherd or whatever it is>

Edit the .travis-ci.yaml and add a stage analysis

- stage: analysis
      name: "Code Analysis"
      services: 
        - mysql
        - docker
      language: java
      addons: 
        sonarcloud:
          organization: "owasp (or whatever)"
          token:
              secure: "base64 key"
      script: "mvn clean org.jacoco:jacoco-maven-plugin:prepare-agent install sonar:sonar -Dsonar.projectKey=ismisepaul_SecurityShepherd -Pdocker -DmongoDocker -B"
    

see here https://github.com/ismisepaul/SecurityShepherd/blob/dev/.travis.yml

Example of current code analysis https://sonarcloud.io/dashboard?id=ismisepaul_SecurityShepherd

Start by reviewing the existing .travis-ci.yaml and the linked example, then verify the OWASP organization key and SonarCloud access requirements. Create sonar-project.properties and configure the analysis stage with the encrypted token; done means Travis can run the SonarCloud analysis without exposing credentials.