CLI-41: Support secrets integration without SonarQube authentication

When no SonarQube server is configured, sonar integrate now installs
secret scanning hooks without requiring a full SonarQube setup
(secrets-only mode). This allows users to get secret scanning protection
immediately, without needing a SonarQube account.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kirill-knize-sonarsource

src/commands/integrate.ts

@@ -399,7 +399,19 @@ export async function integrateCommand(agent: string, options: OnboardAgentOptio
   // Load configuration from all sources
   const config = await loadConfiguration(projectInfo, options);
 
-  // Validate and extract required values
+  // Secrets-only mode: no project key configured — install hooks and exit
+  if (!config.projectKey) {
+    text('\nNo project key configured.');
+    text('Installing secret scanning hooks only.');
+    if (!options.skipHooks) {
+      await installSecretScanningHooks(projectInfo.root);
+      await updateStateAfterConfiguration(true);
+    }
+    outro('Setup complete!', 'success');
+    return;
+  }
+
+  // Full SonarQube integration path
   const { serverURL, projectKey } = validateAndPrintConfiguration(config);
 
   // Ensure token is available

tests/unit/integrate.test.ts

@@ -27,6 +27,7 @@ import * as health from '../../src/bootstrap/health.js';
 import * as repair from '../../src/bootstrap/repair.js';
 import * as auth from '../../src/bootstrap/auth.js';
 import * as keychain from '../../src/lib/keychain.js';
+import * as hooks from '../../src/bootstrap/hooks.js';
 import * as stateManager from '../../src/lib/state-manager.js';
 import { getDefaultState } from '../../src/lib/state.js';
 import { setMockUi, getMockUiCalls, clearMockUiCalls } from '../../src/ui';
@@ -318,27 +319,42 @@ describe('integrateCommand: configuration validation', () => {
     setMockUi(false);
   });
 
-  it('exits 1 when server URL cannot be determined', async () => {
+  it('exits 0 and installs hooks when no project key is configured (secrets-only mode)', async () => {
     const discoverSpy = spyOn(discovery, 'discoverProject').mockResolvedValue(FAKE_PROJECT_INFO);
+    const hooksSpy = spyOn(hooks, 'installSecretScanningHooks').mockResolvedValue(undefined);
     try {
-      await integrateCommand('claude', { project: 'my-project' });
-      expect(mockExit).toHaveBeenCalledWith(1);
-      const errors = getMockUiCalls().filter(c => c.method === 'error').map(c => String(c.args[0]));
-      expect(errors.some(m => m.includes('Server URL'))).toBe(true);
+      await integrateCommand('claude', {});
+      expect(mockExit).toHaveBeenCalledWith(0);
+      expect(hooksSpy).toHaveBeenCalled();
+    } finally {
+      discoverSpy.mockRestore();
+      hooksSpy.mockRestore();
+    }
+  });
+
+  it('shows secrets-only message when no project key is configured', async () => {
+    const discoverSpy = spyOn(discovery, 'discoverProject').mockResolvedValue(FAKE_PROJECT_INFO);
+    const hooksSpy = spyOn(hooks, 'installSecretScanningHooks').mockResolvedValue(undefined);
+    try {
+      await integrateCommand('claude', {});
+      const texts = getMockUiCalls().filter(c => c.method === 'text').map(c => String(c.args[0]));
+      expect(texts.some(m => m.includes('No project key'))).toBe(true);
     } finally {
       discoverSpy.mockRestore();
+      hooksSpy.mockRestore();
     }
   });
 
-  it('exits 1 when project key cannot be determined', async () => {
+  it('exits 0 and installs hooks when server is set but no project key (secrets-only mode)', async () => {
     const discoverSpy = spyOn(discovery, 'discoverProject').mockResolvedValue(FAKE_PROJECT_INFO);
+    const hooksSpy = spyOn(hooks, 'installSecretScanningHooks').mockResolvedValue(undefined);
     try {
       await integrateCommand('claude', { server: 'https://sonarcloud.io' });
-      expect(mockExit).toHaveBeenCalledWith(1);
-      const errors = getMockUiCalls().filter(c => c.method === 'error').map(c => String(c.args[0]));
-      expect(errors.some(m => m.includes('Project key'))).toBe(true);
+      expect(mockExit).toHaveBeenCalledWith(0);
+      expect(hooksSpy).toHaveBeenCalled();
     } finally {
       discoverSpy.mockRestore();
+      hooksSpy.mockRestore();
     }
   });