Security (DevSecOps) · Module 03

SAST with SonarQube

Static analysis of source code to find bugs, vulnerabilities and code smells before it runs: SonarQube and SonarLint, the scanner–server–database architecture, Jenkins integration and blocking merges with a Quality Gate.

Practice interactively →

What you will learn

• Explain SAST and where it sits next to DAST and SCA
• Tell SonarLint in the IDE apart from SonarQube in CI
• Describe the scanner, web server, Elasticsearch, compute engine and database
• Run sonar-scanner with sonar-project.properties or -D parameters
• Add a SonarQube stage and waitForQualityGate to a Jenkinsfile
• Design a Quality Gate based on new code

Lessons

1. What SAST and SonarQube are

   SAST reads source code to find defects without running the program; SonarQube is an automated code review tool that finds bugs, vulnerabilities, security hotspots and code smells, while SonarLint reports them right in the IDE.

2. SonarQube architecture: scanner, server, database

   The scanner runs on the CI machine, analyses source files and sends a report; the server has a web server, an Elasticsearch search server and a compute engine that processes reports and stores them in the database; configure the scanner with sonar-project.properties or -D.

3. Integrating SonarQube into the pipeline

   Run analysis on every build in Jenkins, GitHub Actions, GitLab or Azure DevOps; in Jenkins use the plugin, withSonarQubeEnv and waitForQualityGate, keep the token in credentials and place the scan before the image build and deploy.

4. Quality Gate: blocking merges until quality is met

   A Quality Gate is a set of pass/fail conditions for each analysis; focus it on new code (Clean as You Code), combine it with branch protection to block merges, and use Quality Profiles to choose the rules.