Module Title: dgt_devops06 – Code Quality – SonarQube
Module Description:
This module, “dgt_devops06 – Code Quality – SonarQube,” covers code quality through static analysis and continuous integration practices. Intended for developers and DevOps professionals, it examines the functionality of SonarQube, a tool for identifying bugs, vulnerabilities, and code smells.
You first learn what the quality metrics mean and how SonarQube computes them. Then, in practice, you work only in natural language: you ask the machine to stand up a SonarQube server, wire a scan into the pipeline, and define a Quality Gate with the thresholds you choose. You then read the pipeline configuration and the scanner properties it produced, check that the gate really blocks the merge it should block, and judge whether the issues it reports are real problems or noise.
Key Learning Objectives:
-
Understanding Code Quality Metrics: Gain insight into key quality metrics and understand their impact on software maintainability, reliability, and performance.
-
Introduction to Static Analysis: Learn the fundamentals of static analysis: how it differs from dynamic testing, its benefits, and how it can be used effectively to detect issues early in the development lifecycle.
-
SonarQube:
- Explore the architecture and features of SonarQube.
- Have the machine set up and configure a SonarQube server for your projects, and verify that the setup matches your requirements.
-
Describe in natural language how SonarQube should integrate with popular CI/CD tools such as Jenkins, GitLab CI, or GitHub Actions, and review the integration it builds.
-
Continuous Integration (CI) Strategies: Understand the role of code quality in continuous integration pipelines. Learn best practices for integrating static analysis into CI processes so that code quality is checked on every change.
-
Integrating SonarQube into CI/CD Pipelines:
- Instructing the machine, step by step, to add SonarQube scans to your existing CI/CD workflows, and checking each change it makes.
- Specifying automated code quality checks precisely, and using SonarQube reports to inform development decisions.
-
Strategies for using SonarQube’s Quality Gates to enforce coding standards and prevent low-quality code from progressing through the pipeline.
-
Advanced Features of SonarQube:
- Explore custom rules, plugins, and extensions to tailor SonarQube to your specific needs.
-
Study multi-language support and understand how to manage projects with diverse technology stacks.
-
Case Studies and Natural-Language Exercises: Work through exercises that simulate real-world scenarios. You will direct the machine to build a CI/CD pipeline with SonarQube integration, then analyze the code quality reports, verify that the pipeline behaves as intended, and make informed decisions to improve your project’s codebase.
Target Audience:
- Software developers looking to improve their coding practices.
- DevOps engineers aiming to integrate advanced static analysis tools into CI/CD pipelines.
- Quality assurance professionals interested in automating code review processes.
- IT managers who define code quality standards across teams.
By the end of this module, participants will understand SonarQube in depth and be able to put it to work within their development and deployment workflows by instructing the machine and verifying its output.
The students can push their exercises to the Academy DevOps & SRE Git project. For this module, create a folder with your username as its name in the following subfolder: https://github.com/Garanti-Del-Talento/gdt_academy