SonarQube is an Open Source tool for continuous inspection of code quality. It basically does a static code analysis of your entire code base.

The earlier we identify issues, the easier and cheaper it is to address them. By leveraging the power of Static Code Analysis, developers can get an early feedback for their code changes.

SonarQube has a collection of rules to analyze your source code at compile time to identify potential vulnerabilities, bugs, anti-patterns, refactoring and poor coding practices.

Read my earlier blog post to learn more about SonarQube – 

Manage your Technical Debt with Visual Studio 2015 and SonarQube
 
In my project, we have also integrated SonarQube with our TFS CI/CD build and have configured the Quality Gates.

For example – If I try to inject a security threat or a known coding issue — the TFS build will fail, the check in will get rejected, the quality gate fails and SonarQube points me to the exact issue – which I can rectify and do another check-in. So it will basically stop you from checking in code with potential issues.
 
Currently the only way to catch such issues is during manual coding reviews. SonarQube will help in automating that process. You can write your own rules to look for known issues in the code and stop it before the code gets checked in to source control.
So overall you can ensure good quality code going to Production and less regression defects coming up at a later point of time.

Please find below the sequence of events which occurs when I try to check in code with potential vulnerability —

SonarQube Scanner fails

Code check-in gets rejected

TFS Continuous Integration Build Fails

SonarQube Quality Gates fail

Detailed SonarQube Report shows the new bugs/vulnerabilities introduced 

Clicking on the new vulnerability introduced, it points you to the exact issue in the code and provides suggestion on the code fix

I have been using SonarQube in my projects to ensure high code quality, automate our code review process and also manage our technical debt. I would highly recommend you to start using this tool and leverage its benefits.

Categories: C#, SonarQube, Visual Studio