SonarDesk

Native macOS SonarQube dashboard built with SwiftUI.

Open

Open SonarDesk.xcodeproj in Xcode, select your Development Team under Signing & Capabilities, then Run.

First connection

Open SonarDesk > Settings, add your SonarQube Server URL and a SonarQube user token. Tokens are stored in Keychain.

Included

Multiple SonarQube servers
Keychain token storage
Server status/version
Project dashboard
Quality gate state
Bugs, vulnerabilities, smells, coverage, duplication, LOC
Project detail
Unresolved issue browser/search
Sandboxed outgoing networking

v1.2 dashboard improvements

Colour-accented interactive dashboard cards.
Bugs and Vulnerabilities cards navigate directly to filtered global issues.
Failed Gates card filters the dashboard project list to failing quality gates.
Projects card restores the complete project list.
Dashboard project rows are clickable and open project details.
Dashboard project pagination with 10, 25, and 50 rows per page.
Existing user-defined sidebar project ordering is preserved by pagination.

v1.3

Server-side pagination for All Issues, Bugs, Vulnerabilities and Code Smells (25/50/100 rows).
Dedicated issue destinations in the main sidebar.
Project metric navigation replaces the old View label/buttons; every metric card has a destination.
Professional semantic colour system across dashboard/project metrics.
New SonarDesk application icon and branded launch splash.

v2.0.2 branding fix

AppIcon is explicitly selected by the target and CFBundleIconName.
SonarDeskLogo is bundled as a normal image asset and applied to NSApplication.applicationIconImage at launch, including development runs.
Startup now begins on a dedicated branded launch view for at least 1.6 seconds while the initial SonarQube refresh runs, then transitions into the main UI.

v2.1.0 — Direct distribution hardening

Hardened Runtime explicitly enabled for Debug and Release.
App Sandbox retained with only outbound network access.
No hardened-runtime exception entitlements (no JIT, unsigned executable memory, DYLD injection, or disabled library validation).
Release builds do not inject Xcode debug entitlements.
SonarQube tokens remain in Keychain and are marked ThisDeviceOnly.
Networking uses an ephemeral URLSession with no URL cache or cookie store.
Production SonarQube endpoints must use HTTPS; plain HTTP is limited to localhost development.
Server error response bodies are not surfaced to the UI.
Distribution/ExportOptions.plist is included for Developer ID export.
Distribution/notarize.sh verifies signing, submits with notarytool, staples the ticket, and runs Gatekeeper assessment.

Direct release workflow

In Xcode, set your Apple Developer Team and ensure a Developer ID Application certificate is available.
Product > Archive.
Organizer > Distribute App > Developer ID / Direct Distribution and export the signed app.
Store notarization credentials once, for example: xcrun notarytool store-credentials SonarDesk-Notary --apple-id YOUR_APPLE_ID --team-id YOUR_TEAM_ID --password YOUR_APP_SPECIFIC_PASSWORD
Run: NOTARY_PROFILE=SonarDesk-Notary ./Distribution/notarize.sh /path/to/SonarDesk.app
Distribute the stapled app in a DMG/ZIP. Do not re-sign or modify the app after notarization.

Before every release, test the exported build on a clean macOS user account and run codesign --verify --deep --strict, spctl --assess --type execute, and xcrun stapler validate.