SonarQube Scanner: Missing Timeout Configuration

Answer the question first

The SonarQube Scanner (CLI, Maven, Gradle, MSBuild) does not expose any configuration property that limits the total analysis duration. Therefore, there is no scanner‑side setting you can add to enforce a maximum scan time.

Confirmed facts

• No sonar.* timeout property exists for the analysis phase in any publicly documented scanner version.
• The only server‑side abort mechanism is the Enterprise Edition endpoint /api/analysis/abort, which requires the Administer System permission.
• The scanner does not send a cancellation signal to the CI system; the CI must infer termination from the wrapper’s exit status.

Likely explanation

Because the scanner runs as a ordinary process, the only portable way to bound its execution is to terminate it from the outside (OS or CI scheduler). The abort API can be used only when you have an Enterprise Edition installation and a token with system‑admin rights; otherwise it is not available.

Steps needed for this case

1. Wrap the scanner invocation in a timeout mechanism appropriate to your agent:
   • Linux/macOS agents: timeout 15m sonar-scanner … (GNU timeout exits with code 124 on kill).
   • GitHub Actions: set timeout-minutes on the job or step.
   • GitLab CI: set timeout on the job.
   • Jenkins: wrap the step in timeout(time: 15, unit: 'MINUTES') { … }.
   • Azure DevOps: set timeoutInMinutes on the step or job.
2. If you are using SonarQube Enterprise Edition and possess a token with Administer System permission, you may call the abort endpoint from CI scripts (e.g., curl -X POST -u "token:" https://sonarqube.example.com/api/analysis/abort?projectKey=MY_PROJ). Verify that the token’s role includes the required permission; otherwise the call will be rejected with 403.
3. Treat the wrapper’s exit code (124 for GNU timeout, or the CI system’s cancelled status) as the cancellation signal and configure the pipeline to fail or mark the stage accordingly. No additional scanner‑to‑CI notification channel exists.

Missing diagnostic detail that could change the recommendation

Confirm whether your SonarQube instance is the Enterprise Edition and which version you are running, as the availability and exact permission requirements of /api/analysis/abort may differ across releases. If you are on Community Edition, the abort API is not an option and the CI‑level timeout remains the sole solution.