SonarQube – Rejecting Code Check-in when Quality Gates are not met


SonarQube is an Open Source tool for continuous inspection of code quality. It basically does a static code analysis of your entire code base.

The earlier we identify issues, the easier and cheaper it is to address them. By leveraging the power of Static Code Analysis, developers can get an early feedback for their code changes.

SonarQube has a collection of rules to analyze your source code at compile time to identify potential vulnerabilities, bugs, anti-patterns, refactoring and poor coding practices.

Read my earlier blog post to learn more about SonarQube – 

Manage your Technical Debt with Visual Studio 2015 and SonarQube
 
In my project, we have also integrated SonarQube with our TFS CI/CD build and have configured the Quality Gates.

For example – If I try to inject a security threat or a known coding issue — the TFS build will fail, the check in will get rejected, the quality gate fails and SonarQube points me to the exact issue – which I can rectify and do another check-in. So it will basically stop you from checking in code with potential issues.
 
Currently the only way to catch such issues is during manual coding reviews. SonarQube will help in automating that process. You can write your own rules to look for known issues in the code and stop it before the code gets checked in to source control.
So overall you can ensure good quality code going to Production and less regression defects coming up at a later point of time.

Please find below the sequence of events which occurs when I try to check in code with potential vulnerability —

SonarQube Scanner fails

SonarQube Quality Gate Failure

Code check-in gets rejected

Check-in Rejected

TFS Continuous Integration Build Fails

TFS Build Failed

SonarQube Quality Gates fail

SonarQube Analysis Report

Detailed SonarQube Report shows the new bugs/vulnerabilities introduced 

SonarQube Details

 

Clicking on the new vulnerability introduced, it points you to the exact issue in the code and provides suggestion on the code fix

Issue Details

I have been using SonarQube in my projects to ensure high code quality, automate our code review process and also manage our technical debt. I would highly recommend you to start using this tool and leverage its benefits.

One thought on “SonarQube – Rejecting Code Check-in when Quality Gates are not met

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s