Integrating SonarQube into Your CI/CD Pipeline: Elevating Code Quality and Security
Tags: devops, codequality, tutorial, cloud
Published: 2024-02-26 01:23:40

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a32riwzaz5p69monxai5.png)
_Adding Sonarqube into our workflow, code and security analysis._





**Pre-requisites**
- Read the 1st part
- Ngrok app

**For clarification**
>_I tried to install it on the t2.micro instance but Sonarqube requires 2 gb ram_

![Requirementes of Sonarqube](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cdf7th06el2zc26p85ma.png)
>_We will install it on our local machine to do everything for free at least in this test environment, but in AWS a t2.medium is recommended (it is not free tier)._

**Deploy Sonarqube**
- Sonarqube [compose](https://github.com/Sharker3312/Devops-Projects/blob/main/CD_pipeline_for_an_app/sonarqube.yml) file
- cd /path(compose file)

```bash
docker-compose up -d
```
>_In sonarqube it is typical to find this error when deploying the container._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hrwatyk5zucz3w4krrgb.png)
_The solution is simple paste into the CLI the next code_

```bash
sudo sysctl -w vm.max_map_count=262144
```
Opening Sonarqube Web -> _http://localhost:9000_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qf6tphhulsfa5os2slhp.png)
>_Well as sonarqube is in our localhost now we will expose it to the internet_
- Tunneling app to internet through [Ngrok](https://ngrok.com/docs/getting-started/)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/72lmlp6rhxjrqcmjiceb.png)
>_Our Sonarqube is now exposed to the internet_

**Configure Jenkins to add Sonarqube**
1. Go to **Jenkins** -> **Manage** Jenkins -> **Plugins** ->**Available** plugins
2. Install **SonarQube Scanner**
 
>_Now we configure the plugin_
1. Manage Jenkins -> **System**
2. Search **SonarQube servers** -> **Click** Environment variables

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4ev1mzugttmtywjfc8cu.png)

- Go to SonarQube Web
- Click in **Administration** bar -> **Security**-> **Users**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zjilsbpt550owcvcx1eu.png)
- Click Token and name it
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ddlpfqkzq5mhppc2l8hu.png)

>_Now copy the token into the jenkins configuration variable_
- Press Add
- Kind= Secret text
>_ID and description name them as you wish_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gly83wk3t4nmqxjd6hqj.png)
- Change Server authentication token

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lud6kjr60ec45bazy7lh.png)
- Save

---


##CodeQuality Stage
>_Take a look to the pipeline [project](https://github.com/Sharker3312/sonar-test)_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x60ey2o15bgum5rgtq1m.png)
<u>tools: maven 3.9.6</u>
Go to **Manage Jenkins** -> **Tools** -> **Maven**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qbsn2wu5kzf876zt3xfi.png)

**Ready to run the job**
- Build the job

1. **New Item** -> **Pipeline**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r06jgrlvzph8n9j8lih0.png)
<u>Check the correct branch</u>

>_run_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dc7uv4o1ph2awkr9cyj5.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2fyzo0ozgk5ckt90wtxt.png)

- Pulsa sobre el icono de sonarqube en la web, y haz click en el proyecto demo

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jlxzi71t9ym9c8xfnr40.png)

**Quality Gate**
>_What is a quality gate for?_ 
>This function is used to wait for a certain time until the code analysis is completed
It's simple to use, just add the next code to the **pipeline**

```bash
stage("Quality Gate") {
      steps {
        timeout(time: 2, unit: 'MINUTES') {
          waitForQualityGate abortPipeline: true
        }
      }
    }
```

---
<a href="https://linkedin.com/in/lesterdprez" rel="nofollow"><img src="https://camo.githubusercontent.com/d94940866c98cb4fca5783c4e8ac95776d2f52df6bbf3d5ab9e30d76836f30ae/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c696e6b6564496e2d2532333030373742352e7376673f6c6f676f3d6c696e6b6564696e266c6f676f436f6c6f723d7768697465" alt="LinkedIn" data-canonical-src="https://img.shields.io/badge/LinkedIn-%230077B5.svg?logo=linkedin&amp;logoColor=white" style="max-width: 100%;"></a>