Update: We needed separate scans (therefore also separate REXX execs) for C and CPP because sonar scanner requires that the header files for C and CPP have distinct names. Therefore, up to three scans can execute per package, one scan each for the COBOL (plus copybooks), C (plus headers), and CPP (plus headers) source code. We have not tried scanning JCL or any other source code types yet. Each scan corresponds to a stand-alone job. The scanning does not delay the package processing which was a concern expressed by co-workers and developers. By using a JES initiator that allows only one job to execute and using the same job name for all of the scans we can avoid multiple scans running simultaneously which enables us to delete the remote files created for each scan before starting a new scan.
------------------------------
[FirstName]
------------------------------
Original Message:
Sent: Jun 09, 2026 09:39 AM
From: Mathew Goldstein
Subject: New Endevor Blog: Integrating Packages with SonarQube
I opted to implement this as an after-cast exit, with a before cast exit forcing a batch package cast that executes under the alternate ID for secure file transfers using SFTP. The first REXX script then verifies that the cast was successful before proceeding. The first REXX script can filter which packages are processed this way based on your local package ID standards and other package information (such as whether it is promotion package), in addition to the package notes text. We currently have two more REXX scripts, one for COBOL and the other for C\CPP, which are executed only if the package contains the corresponding type of source code. The execution of the python script that executes the sonar scanner CLI stalls the processing until the scanning completes so I accordingly found no need to implement the wait code. We finish by deleting all of the files on the remote platform followed by sending a notification email when a search of the results dataset does not indicate "SUCCESS" and then deleting all of the datasets. This was implemented starting with somewhat older version of the GitHub code then is currently available, and our python script was modified to eliminate the requests module with the help of AI.
------------------------------
[FirstName]
------------------------------