EEdukron DevOps Library
Quality EngineeringIntermediate10 submodules

SonarQube and Code Quality

Measure source quality with SonarQube analysis, coverage, profiles, and gates so maintainability and correctness become enforceable delivery evidence.

How this module works

From concept to production evidence

Analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Learning outcomes

  • Explain SonarQube architecture
  • Configure projects and quality profiles
  • Interpret bugs, vulnerabilities, smells, and coverage
  • Design meaningful quality gates
  • Integrate analysis with Azure Pipelines

Flow diagram

SonarQube and Code Quality end-to-end flow

Use this sequence as the operating backbone for every submodule note and hands-on exercise.

  1. 01
    Compile analyzable codeSonarQube and Code Quality stage 1: compile analyzable code with an auditable result before the next stage begins.
  2. 02
    Run scannerSonarQube and Code Quality stage 2: run scanner with an auditable result before the next stage begins.
  3. 03
    Evaluate profileSonarQube and Code Quality stage 3: evaluate profile with an auditable result before the next stage begins.
  4. 04
    Publish findingsSonarQube and Code Quality stage 4: publish findings with an auditable result before the next stage begins.
  5. 05
    Calculate quality gateSonarQube and Code Quality stage 5: calculate quality gate with an auditable result before the next stage begins.
  6. 06
    Pass or block pipelineSonarQube and Code Quality stage 6: pass or block pipeline with an auditable result before the next stage begins.

Integrated hands-on lab

Add a SonarQube quality gate

  1. Create project and token
  2. Configure scanner in CI
  3. Select quality profile
  4. Publish coverage and analysis
  5. Fail the pipeline on new-code gate breach

Complete module contents

10 full submodule notes

Read in order
01

Static code analysis

Static code analysis provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
02

SonarQube architecture

SonarQube architecture defines the major responsibilities, boundaries, and control flow that engineers use before selecting an implementation detail within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
03

Projects

Projects provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
04

Quality Profiles

Quality Profiles preserves durable information with explicit ownership, consistency, access, lifecycle, replication, and recovery guarantees within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
05

Quality Gates

Quality Gates provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
06

Bugs

Bugs provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
07

Vulnerabilities

Vulnerabilities provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
08

Code smells

Code smells provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
09

Code coverage

Code coverage provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes
10

Azure Pipeline integration

Azure Pipeline integration governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within SonarQube and Code Quality. It is not an isolated definition: its value appears when it supports analyze every change early, apply language-appropriate rules, distinguish defects from maintainability findings, track new code separately from legacy debt, and block promotion when an agreed gate fails.

Open full notes