How to Restrict User to update bug,code smell, vulnerabilities, duplication

Question

I am using soarqube version 8.4.2. We have different groups to review code in sonarqube. but i need to create one group, whose user can just check and see reports and can not access/ update issue or bug from dashboard of sonarqube.

I have tried over internet but i could not find any suitable stpes to restrict user for it.

I would appreciate if any one share me suggestion, or document regarding it.

Thanks in advance.

Answer 1

In Sonarqube, Go to the Project for which you want to apply permissions for a group of users.

Then, click on the drop down tab Administration >> Permissions >> Click on Groups

Then, search for the Group for which you want to apply permissions.

There are 6 different types of permissions, you can assign to a group or users. Types of Permissions available under Project Administration are:

1. Browse: Access a project, browse its measures and issues, confirm issues, change the assignee, comment on issues and change tags.
2. See Source Code: View the project's source code. (Users will also need "Browse" permission)
3. Administer Issues: Change the type and severity of issues, resolve issues as being "fixed", "won't fix" or "false-positive" (users also need "Browse" permission).
4. Administer Security Hotspots: Open a Vulnerability from a Security Hotspot. Resolved a Security Hotspot as reviewed, set it as in review or reset it as to review (users also need Browse permission).
5. Administer: Access project settings and perform administration tasks. (Users will also need "Browse" permission)
6. Execute Analysis: Ability to get all settings required to perform an analysis (including the secured settings like passwords) and to push analysis results to the SonarQube server.

For your case, you can assign the Browse and See Source code. Please find the screenshot:

Note: You need administrator access to perform this permission changes.