Your CI/CD pipeline runs SonarQube analysis but developers complain it adds 5 minutes to their build. How do you optimize SonarQube scanner performance and reduce analysis time?

# sonar-project.properties - optimized configuration
sonar.projectKey=order-service
sonar.sources=src/main/java
sonar.tests=src/test/java

# Exclusions - skip non-essential code
sonar.exclusions=**/generated/**,**/proto/**,**/vendor/**,**/*_test.go
sonar.coverage.exclusions=**/config/**,**/dto/**,**/entity/**,**/*Config.java
sonar.cpd.exclusions=**/migrations/**
sonar.test.exclusions=**/testdata/**

# Specify exact coverage report path (avoid filesystem scanning)
sonar.coverage.jacoco.xmlReportPaths=build/reports/jacoco/test/jacocoTestReport.xml

# Scanner JVM tuning
export SONAR_SCANNER_OPTS="-Xmx2g -XX:+UseG1GC"

# GitHub Actions with caching
jobs:
  sonarqube:
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Cache SonarQube scanner packages and analysis cache
      - uses: actions/cache@v4
        with:
          path: |
            ~/.sonar/cache
            .scannerwork
          key: sonar-${{ runner.os }}-${{ hashFiles('**/sonar-project.properties') }}
          restore-keys: sonar-${{ runner.os }}-

      - name: SonarQube Scan
        run: |
          sonar-scanner \
            -Dsonar.projectKey=order-service \
            -Dsonar.scm.disabled=false \
            -Dsonar.cpd.cross_project=false
        # cpd.cross_project=false avoids cross-project duplication check (slow)

# For Gradle/Maven - use native scanner (leverages compiled bytecode)
# build.gradle.kts
plugins {
    id("org.sonarqube") version "5.0.0.4638"
}
sonar {
    properties {
        property("sonar.projectKey", "order-service")
        property("sonar.host.url", System.getenv("SONAR_HOST_URL"))
    }
}
# Run: ./gradlew sonar (reuses compiled classes, faster than standalone scanner)

# Server-side: increase Compute Engine workers
# sonar.properties
sonar.ce.workerCount=4

# Async Quality Gate with webhook (avoid polling timeout)
# sonar-project.properties
sonar.webhooks.project=https://ci.company.com/sonar-webhook

# Monitor analysis time
curl -u admin:$TOKEN \
  "https://sonar.company.com/api/ce/activity?component=order-service&ps=5" \
  | jq '.tasks[] | {date: .submittedAt, duration: .executionTimeMs, status: .status}'

# Monorepo: only scan affected modules
#!/bin/bash
CHANGED_MODULES=$(git diff --name-only origin/main...HEAD | \
  grep -oP '^[^/]+' | sort -u | tr '\n' ',')
sonar-scanner -Dsonar.modules=$CHANGED_MODULES