Duration
2 days
Overview
SonarQube is a code quality testing tool developed by SonarSource for performing automatic reviews to detect bugs and security vulnerabilities. It can be integrated easily into existing workflows and build pipelines for continuous code inspection. This instructor-led, live training (online or onsite) is aimed at DevOps engineers and developers who wish to use SonarQube to run code reviews that are fully-integrated into development tool chains, such as Jenkins, GitHub, Azure DevOps, etc. By the end of this training, participants will be able to:
- Set up the necessary development environment to start running automatic code reviews.
- Integrate SonarQube with continuous integration tools, such as Jenkins, Azure DevOps, etc.
- Run continuous code inspections to eliminate bugs and security vulnerabilities.
- Collect and analyze data to drive improvements for code cleanup, maintenance, and security.
Format of the Course
Interactive lecture and discussion.
Lots of exercises and practice.
Hands-on implementation in a live-lab environment.
Prerequisites
Experience with DevOps administration.
Audience
DevOps engineers
Developers
Introduction
- Overview of SonarQube features and architecture
Getting Started
- Installing and configuring the server
- Navigating the SonarQube server UI
- Setting up SonarScanner with build tools (Gradle, Maven, Ant, etc.)
Integrating with DevOps Tools
- Installing and configuring Jenkins plugins
- Importing Azure DevOps repositories into SonarQube
- Setting up projects with GitHub Repositories
Running Code Tests and Analysis
- Defining analysis parameters
- Executing tests and generating data
- Working with third-party analyzers
Improving and Maintaining Code Quality
- Analyzing project history
- Defining rules with Quality Profiles
- Enhancing global security features
- Adding coding rules with SonarQube APIs
- Best practices and tips
Troubleshooting
Summary and Next Steps
Programme scope, delivery arrangements and suitability are confirmed during enquiry.