AdvancedLesson 7

CI/CD Integration

ELI5 Explanation

Integrating SonarQube into a pipeline means code quality is checked automatically every time someone pushes — no manual scans, no forgotten checks, no surprises at release time.

Technical Explanation

The integration pattern is: build → test → scan → gate check → promote. On pull requests, branch analysis allows SonarQube to report only on new code. On merge to main, full analysis runs. Quality Gate status is polled by the pipeline: a FAILED status stops promotion.

Both Jenkins and GitHub Actions have mature integration options, using the SonarQube plugin (Jenkins) or the SonarSource/sonarqube-scan-action (GitHub Actions).

Important: Always pass sonar.pullrequest.key and related branch params on PR scans — without them SonarQube cannot decorate pull requests with inline feedback.

Visual

git push / PR
→
Build + Test
→
sonar-scanner
→
Gate: PASS?
→
Merge / Deploy

Hands-on Commands

GitHub Actions pipeline integration
# .github/workflows/sonar.yml
name: SonarQube Analysis
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  sonar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0        # full history for accurate blame/diff

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Build and test
        run: mvn clean verify

      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      - name: Check Quality Gate
        uses: SonarSource/sonarqube-quality-gate-action@master
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
Jenkins pipeline integration
// Jenkinsfile
pipeline {
  agent any
  stages {
    stage('Build') { steps { sh 'mvn clean package -DskipTests' } }
    stage('Test')  { steps { sh 'mvn test' } }
    stage('SonarQube') {
      steps {
        withSonarQubeEnv('SonarQube') {
          sh 'mvn sonar:sonar -Dsonar.projectKey=my-app'
        }
      }
    }
    stage('Quality Gate') {
      steps {
        timeout(time: 3, unit: 'MINUTES') {
          waitForQualityGate abortPipeline: true
        }
      }
    }
  }
}

Debugging Scenario

Pipeline always shows gate PASSED even when new bugs are introduced. Root cause: fetch-depth: 0 is missing in GitHub Actions checkout, so SonarQube sees no diff and reports on no new code. New code analysis requires full Git history to determine what changed. Always use fetch-depth: 0.

Interview Questions

Beginner

  • Why integrate SonarQube into CI/CD?
  • What is the difference between a scan step and a gate check step?
  • Where should the SONAR_TOKEN be stored?
  • What happens if the quality gate fails?
  • Can SonarQube add comments to pull requests?

Intermediate

  • How does branch analysis differ from main branch analysis?
  • Why does SonarQube need full Git history on checkout?
  • How do you handle parallelism if multiple services scan at once?
  • How do you pipeline SonarQube in a monorepo with 10 services?
  • What timeout strategy is appropriate for the quality gate step?

Scenario-based

  • Pipeline scan succeeds but no results appear in SonarQube UI. What do you check?
  • PRs from forks fail because SONAR_TOKEN is unavailable. How do you handle this safely?
  • Scan runs fine but quality gate step always times out. What is the likely cause?
  • You need to exclude auto-generated proto files from all repo scans. How do you standardize this?
  • Release pipeline must never block on code smells, only on bugs. How do you configure it?

Real-world Use Case

A fintech platform standardized a shared GitHub Actions reusable workflow for SonarQube scanning across 50 repositories. Any repo calling the shared workflow automatically had consistent quality gating without per-team configuration.

Summary

CI/CD integration makes quality gating automatic, consistent, and impossible to skip. Next lesson shows these principles in realistic real-world delivery scenarios.

PreviousReports & Dashboards