SonarQube for DevOps¶
2 days · 9:00–16:00 Intermediate 10 hands-on labs on-site or remote · English / Polish
Automated code review with SonarQube Community Build 26.10 for BookShelf, a small online bookstore with a Java and a Python service. Participants take it from "nobody looks at code quality" to gated code reviews in every pipeline – scanners, tests and coverage, third-party analyzers, quality profiles and gates, Jenkins, GitHub Actions and Azure DevOps, security, the Web API and troubleshooting.
Who it's for¶
DevOps engineers, developers, team leads and QA engineers who want automated, enforceable code quality in their delivery pipelines.
Prerequisites: basic Git and CI/CD knowledge, Linux shell, reading Java or Python code.
What you will be able to do¶
- Install and configure SonarQube with PostgreSQL in Docker
- Analyse code with the Maven plugin and SonarScanner CLI, read and triage issues
- Import tests and coverage, scope analyses, understand new code
- Bring Bandit, Ruff, Pylint and your own tools in with the generic issue format
- Build inherited quality profiles and quality gates that block bad releases
- Gate pipelines in Jenkins, GitHub Actions and Azure DevOps
- Secure SonarQube: permissions, templates, least-privilege tokens
- Automate with the Web API, custom rules and quality configuration as code
- Diagnose broken analyses quickly
Agenda¶
Environment¶
Labs run on one Linux VM (4 vCPU, 8 GB RAM) with Docker Compose: SonarQube, PostgreSQL, Jenkins and Gitea start with ./bin/lab up. LAB07 additionally needs a GitHub account or an Azure DevOps organisation.