{"id":3253,"date":"2021-06-25T13:59:00","date_gmt":"2021-06-25T11:59:00","guid":{"rendered":"https:\/\/blog.besharp.it\/?p=3253"},"modified":"2021-06-28T11:56:57","modified_gmt":"2021-06-28T09:56:57","slug":"how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis","status":"publish","type":"post","link":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/","title":{"rendered":"How to enrich your CI\/CD pipelines with static code analysis"},"content":{"rendered":"\n<p>In the past, we covered continuous delivery pipelines in multiple blog posts; that&#8217;s because having an automatic, reliable, and fully managed way to test and deploy code helps to increase development throughput and the quality of the production code.<\/p>\n\n\n\n<p>An efficient CI\/CD pipeline is necessary to accelerate software delivery without sacrificing quality, and a static code analysis tool should be a step of each continuous delivery pipeline.&nbsp;<\/p>\n\n\n\n<p>A static code analysis tool inspects your codebase through the development cycle, and it&#8217;s able to identify bugs, vulnerabilities, and compliance issues without actually running the program.&nbsp;<\/p>\n\n\n\n<p>The code analysis may help to ensure that your software is secure, reliable, and compliant.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is static code analysis?<\/h2>\n\n\n\n<p>Static code analysis is a practice that allows your team to automatically detect potential bugs, security issues, and, more generally, defects in a software&#8217;s codebase. Thus, we can view static analysis as an additional automated code review process. Let&#8217;s examine this analogy more in detail.<\/p>\n\n\n\n<p>The code review process is probably the better way to improve the quality of the code. During a code review, a pair of programmers read the code with the precise goal to improve it and to spot dangerous practices from both maintainability and security perspectives.&nbsp;<\/p>\n\n\n\n<p>During the review process, the code&#8217;s author should not explain how certain program parts work so that the reviewer is not biased on its judgment. In addition, the code should be clear to understand and highly maintainable; the complexity of the code should be mitigated by abstraction and incapsulation. Finally, the code should be deemed sufficiently clear, maintainable and safe, by both the programmers to pass the review.<\/p>\n\n\n\n<p>The code review usually works well because it&#8217;s easier for the programmer to spot bugs, code smells and to suggest improvements on somebody else code.&nbsp;<\/p>\n\n\n\n<p>It would be best to practice code reviews as frequently as possible; however, the activity is very time-consuming and costly.<\/p>\n\n\n\n<p>An excellent way to increase the frequency of code reviews is to include static code analysis in the delivery pipeline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Static Code Analysis tools and solutions<\/h2>\n\n\n\n<p>There are instruments and solutions to implement static code analysis that can automatically scan your codebase and generate an accurate report for the developers. Such tools are usually easy to integrate as a step in the continuous delivery pipeline; usually, the return code can determine if the code is good enough or if the release fails the static analysis.<\/p>\n\n\n\n<p>Of course, a fully automated solution cannot substitute a complete code review performed by a developer. Still, the increased ratio of code analysis plus the relatively cheap impact on overall pricing makes adding an analysis step to your pipeline an efficient way to improve code quality and security.<\/p>\n\n\n\n<p>There are three main categories of improvements that static code analysis can pinpoint:<\/p>\n\n\n\n<ul><li>Detect possible bugs and security issues<\/li><li>Give recommendations on code formatting, and detect code smells.&nbsp;<\/li><li>Compute various code metrics<\/li><\/ul>\n\n\n\n<p>Many commercial and free static code analyzers support a vast plethora of programming languages. One of the most famous is <strong>Sonarqube<\/strong>, which we will better describe later.<\/p>\n\n\n\n<p>From AWS, we can also leverage <strong>CodeGuru<\/strong>, a machine learning-powered service that is easy to integrate into pipelines and can provide high-quality suggestions to improve the code. Unfortunately, at the moment, CodeGuru only supports Java and Python (in preview).<\/p>\n\n\n\n<p>CodeGuru aims to become a robust and high-quality analysis tool. However, at the moment, it\u2019s only stable to use for java developers; thus, we will focus on a more mature solution that can be used for a lot of languages.<\/p>\n\n\n\n<p>This article will deep dive into <strong>Sonarqube<\/strong> and how to integrate it into a continuous delivery pipeline.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.sonarqube.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Sonarqube<\/a> is open-source software for continuous inspection of code quality. It performs automatic reviews with static analysis on more than 20 programming languages. It can spot duplicated code, compute code coverage, code complexity, and finds bugs and security vulnerabilities. In addition, it can record metrics history and provides evolution graphs via a dedicated web interface.<\/p>\n\n\n\n<p>The drawback of using SonarQube is that you can either subscribe to the managed SonarQube service (not provided by AWS) or manage your own installation.<\/p>\n\n\n\n<p>We usually leverage fully managed services for the development pipeline because it allows us to focus on our work rather than the infrastructure or tools needed to make the pipeline.&nbsp;<\/p>\n\n\n\n<p>However, in this case, we opted for a hosted solution due to a pricing model not compatible with our usage. In addition, the automatic review step is not a pipeline blocker during development, making the availability of the cluster not critical for the development cycle.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">SonarQube setup on AWS<\/h2>\n\n\n\n<p>This brief tutorial will provide high-level instructions to set up a SonarQube cluster on AWS leveraging managed services.<\/p>\n\n\n\n<p>We will make a highly available and scalable cluster powered by ECS Fargate and Amazon Aurora Serverless.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image5-1-1024x576.png\" alt=\"highly available and scalable cluster powered by ECS Fargate and Amazon Aurora Serverless\" class=\"wp-image-3263\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image5-1-1024x576.png 1024w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image5-1-400x225.png 400w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image5-1-768x432.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image5-1-1536x864.png 1536w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image5-1.png 1999w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Create Amazon Aurora Serverless Cluster.<\/h3>\n\n\n\n<p>To work correctly, SonarQube needs a PostgreSQL or MySQL database. Therefore, we will use Amazon Aurora Serverless with PostgreSQL compatibility.<\/p>\n\n\n\n<p>To create it, simply go to the AWS Management Console under the AWS RDS service and click the button &#8220;Create database.\u201d In the following form, select Amazon Aurora as Engine type, Amazon Aurora with PostgreSQL compatibility as Edition, and Serverless as the Capacity type like the image below.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image12-1-757x1024.png\" alt=\"create database - AWS RDS\" class=\"wp-image-3277\" width=\"756\" height=\"1023\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image12-1-757x1024.png 757w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image12-1-222x300.png 222w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image12-1-768x1039.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image12-1.png 855w\" sizes=\"(max-width: 756px) 100vw, 756px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Finally, finish the cluster configuration setting up the database name, password, and all the networking configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Create Application Load Balancer and Target Group<\/h3>\n\n\n\n<p>To expose the Fargate service that will contain our Sonarqube Application, we need to create an AWS Application Load Balancer with his Target Group. If you want to serve it using the HTTPS protocol, you have to create or import an SSL certificate inside the AWS Certificate Manager. Otherwise, in the creation of the load balancer, you can only configure the listener on port 80.<\/p>\n\n\n\n<p>Let&#8217;s start creating the Target Group from the AWS Management Console under the EC2 service page. Go to the Target Group section and click the &#8220;Create target group&#8221; button. Choose &#8220;Ip address&#8221; as target type, HTTP as protocol, and 9000 as the port; also, make sure to select HTTP1 as the protocol version.<\/p>\n\n\n\n<p>Now that we have our Target Group, we can create the Application Load Balancer. To do that, simply go to the load balancer section inside the EC2 Console and click the Create Load Balancer button. Then, click the Create button under the Application Load Balancer Section in the wizard as in the image below.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"427\" height=\"534\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image6-1.png\" alt=\"Create application load balancer\" class=\"wp-image-3265\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image6-1.png 427w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image6-1-240x300.png 240w\" sizes=\"(max-width: 427px) 100vw, 427px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>Choose the internet-facing scheme and add two listeners, one on 80 port and one on 443 port. Remember to attach it to the public subnet of your VPC like the image below.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"658\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image2-2-1024x658.png\" alt=\"\" class=\"wp-image-3308\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image2-2-1024x658.png 1024w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image2-2-400x257.png 400w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image2-2-768x494.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image2-2.png 1402w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>In the next section (only if you choose to have the 443 port listener), select an SSL certificate from AWS Certificate Manager.<\/p>\n\n\n\n<p>Then, in the configure routing section, just select the Target group that you have already created.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"856\" height=\"779\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image11-1.png\" alt=\"Configure routing - application load balancer\" class=\"wp-image-3275\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image11-1.png 856w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image11-1-330x300.png 330w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image11-1-768x699.png 768w\" sizes=\"(max-width: 856px) 100vw, 856px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>If you choose to have the 443 port listener, you have to change its behaviour. To do that, simply select your load balancer; in the Listener section, select the port 80 listener and then click the Edit button.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"384\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image9-1-1024x384.png\" alt=\"in the Listener section, select the port 80 listener\" class=\"wp-image-3271\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image9-1-1024x384.png 1024w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image9-1-400x150.png 400w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image9-1-768x288.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image9-1.png 1060w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>In the edit page, delete the default behaviour and re-create it by clicking the button &#8220;Add action\u201d. In the checklist, select the &#8220;Redirect to&#8221; value and insert the 443 port in the appropriate box.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"580\" height=\"670\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image4-1.png\" alt=\"select the &quot;Redirect to&quot; value\" class=\"wp-image-3261\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image4-1.png 580w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image4-1-260x300.png 260w\" sizes=\"(max-width: 580px) 100vw, 580px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Create Fargate Cluster<\/h3>\n\n\n\n<p>Go to the AWS ECS console under the Amazon ECS Cluster section and click the &#8220;Create cluster&#8221; button. Next, select the &#8220;Networking only&#8221; template like the image below.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"855\" height=\"787\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image3-1.png\" alt=\"select cluster template\" class=\"wp-image-3259\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image3-1.png 855w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image3-1-326x300.png 326w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image3-1-768x707.png 768w\" sizes=\"(max-width: 855px) 100vw, 855px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>Choose a name and click the &#8220;Create&#8221; button.<br>In the IAM Management Console, create a new IAM Role and attach the AWS Managed policy called &#8220;<a href=\"https:\/\/console.aws.amazon.com\/iam\/home?#\/policies\/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2Fservice-role%2FAmazonECSTaskExecutionRolePolicy\">AmazonECSTaskExecutionRolePolicy<\/a>&#8221; and &#8220;<a href=\"https:\/\/console.aws.amazon.com\/iam\/home?#\/policies\/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2Fservice-role%2FAmazonEC2ContainerServiceRole\">AmazonEC2ContainerServiceRole<\/a> &#8220;.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"179\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image7-1-1024x179.png\" alt=\"create a new IAM Role and attach the AWS Managed policy\" class=\"wp-image-3267\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image7-1-1024x179.png 1024w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image7-1-400x70.png 400w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image7-1-768x134.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image7-1-1536x268.png 1536w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image7-1.png 1614w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>In the AWS ECS Task Definition section, click the button &#8220;Create new Task Definition&#8221; and choose the Fargate launch type.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"934\" height=\"741\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image10-1.png\" alt=\"choose the Fargate launch type\" class=\"wp-image-3273\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image10-1.png 934w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image10-1-378x300.png 378w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image10-1-768x609.png 768w\" sizes=\"(max-width: 934px) 100vw, 934px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>As the &#8220;Task role&#8221; and &#8220;Task execution role&#8221; properties, select the role you have created.<\/p>\n\n\n\n<p>In the &#8220;Task size&#8221; section, select 8GB for the ram and 2 CPU.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1011\" height=\"1010\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image13-1.png\" alt=\"configure task and container definitions\" class=\"wp-image-3279\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image13-1.png 1011w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image13-1-300x300.png 300w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image13-1-768x767.png 768w\" sizes=\"(max-width: 1011px) 100vw, 1011px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>In the container section, add a new container and use &#8220;public.ecr.aws\/bitnami\/sonarqube:8.9.1&#8221; as the image of the task. This image is the official version of Sonarqube hosted by AWS ECR Public. If You want, you can use your ECR private repository with your custom Docker image. In the port mapping, map the 9000 port of the container.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"516\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image1-1-1024x516.png\" alt=\"port mapping\" class=\"wp-image-3255\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image1-1-1024x516.png 1024w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image1-1-400x202.png 400w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image1-1-768x387.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image1-1.png 1224w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>In the Environment Variable section, you have to add the database endpoint using these variables:<\/p>\n\n\n\n<ul><li>SONARQUBE_JDBC_URL: The JDBC URLports to the Aurora Serverless Cluster, an important thing is that you have to add some query parameters for SSL mode for the compatibility with Aurora Serverless and Sonarqube; e.g., <em>jdbc:postgresql:\/<\/em><strong><em>YOUR_DATABASE_ENDPOINT<\/em><\/strong><em>:5432\/<\/em><strong><em>YOUR_DATABASE_NAME?sslmode=require&amp;gssEncMode=disable<\/em><\/strong><\/li><li>SONARQUBE_JDBC_USERNAME: Your Aurora Serverless username.<\/li><li>SONARQUBE_JDBC_PASSWORD&gt; Your Aurora Serverless password.<\/li><\/ul>\n\n\n\n<p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"263\" src=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image8-1-1024x263.png\" alt=\"SonarQube environment variables\" class=\"wp-image-3269\" srcset=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image8-1-1024x263.png 1024w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image8-1-400x103.png 400w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image8-1-768x197.png 768w, https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/image8-1.png 1174w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>At this point, you can configure a service for the SonarQube cluster. For example, you can define a service specifying a task and a set of parameters that determine how many instances of the task are required as a minimum, current, and maximum value to allow the service to function correctly. You can read more on how to set up a service in our previous article <a href=\"https:\/\/blog.besharp.it\/aws-fargate-services-deployment-with-continuous-delivery-pipeline\/\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n\n\n\n<p>In the end, you should be able to access your installation using the elastic load balancer URL.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Integrate SonarQube scan into the pipeline<\/h2>\n\n\n\n<p>Now that the cluster is up and running, we can access it and start configuring SonarQube. We can fine-tune the inspection configuration and preferences. Once our project is created and configured, we can automatically trigger a code analysis, adding a step in our CD pipeline.<\/p>\n\n\n\n<p>There are multiple ways to achieve this. The most common and easy to implement is just to add a piece of script into the build step. To trigger a code analysis, you have to install an agent and then run a command to start the process.&nbsp;<\/p>\n\n\n\n<p>The agent can be pre-installed in the build container, the latest release of the agent is <a href=\"https:\/\/docs.sonarqube.org\/latest\/analysis\/scan\/sonarscanner\/\" target=\"_blank\" rel=\"noreferrer noopener\">available here for download<\/a>.<\/p>\n\n\n\n<p>When the agent is in place, you can start an analysis by running this command.<\/p>\n\n\n\n<pre>sonar-scanner \n-Dsonar.projectKey=[PROJECT_KEY]\n-Dsonar.sources=.\n-Dsonar.host.url=[LOAD_BALANCER_URL]\n-Dsonar.login=[LOGIN_KEY]\n-Dsonar.qualitygate.wait=true\n-Dsonar.qualitygate.wait=true<\/pre>\n\n\n\n<p>The last parameter tells the scanner to wait for the scan to end and return a non 0 exit code if the quality of the release is below the configured threshold.<\/p>\n\n\n\n<p>In this way, the build step of the pipeline will fail if the code quality isn\u2019t good enough.<\/p>\n\n\n\n<p>Whenever the pipeline stops when the scan fails is a crucial aspect of the entire process.<\/p>\n\n\n\n<p>As already suggested, code analysis is cheap and should be executed as much as possible. However, the development process should be halted every time a code analysis fails.&nbsp;<\/p>\n\n\n\n<p>It\u2019s good to scan and generate the report at each commit without stopping the release, especially in the dev environment.<\/p>\n\n\n\n<p>However, the pipeline can be hardened in staging and production environments to ensure that the quality is not impaired. Pipelines that deliver to any \u201cnon-dev\u201d environment should fail if the code analysis is not good enough, using the parameter highlighted above.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusions<\/h2>\n\n\n\n<p>Static code analysis is a reliable and precious practice to include in the development cycle.<br>There are both AWS options like CodeGuru and many commercial and\/or open-source platforms like SonarQube that you can subscribe to or host.<\/p>\n\n\n\n<p>No matter what your application does or how your development cycle is structured, if you have continuous delivery pipelines, you should consider adding an automatic code analysis step and ensure that the release stops for customer-facing environments if the code quality is not satisfactory.<\/p>\n\n\n\n<p>Stay tuned for other articles about code quality and automatic delivery pipelines.<\/p>\n\n\n\n<p>See you in 14 days on #Proud2beCloud!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the past, we covered continuous delivery pipelines in multiple blog posts; that&#8217;s because having an automatic, reliable, and fully [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":3286,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[242],"tags":[369,296],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.9.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to enrich your CI\/CD pipelines with static code analysis - Proud2beCloud Blog<\/title>\n<meta name=\"description\" content=\"This article will dive deep into Sonarqube and how to integrate it into a continuous delivery pipeline to enrich it with static code analysis\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Enriching CI\/CD pipelines with static code analysis using SonarQube\" \/>\n<meta property=\"og:description\" content=\"Integrating SonarQube into CI\/CD Pipelines to enrich them with static code analysis.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/\" \/>\n<meta property=\"og:site_name\" content=\"Proud2beCloud Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-06-25T11:59:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-28T09:56:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/twitter-shared-link-8.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Alessio Gandini\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Enriching CI\/CD pipelines with static code analysis using SonarQube\" \/>\n<meta name=\"twitter:description\" content=\"Integrating SonarQube into CI\/CD Pipelines to enrich them with static code analysis.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/twitter-shared-link-8.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alessio Gandini\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/\",\"url\":\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/\",\"name\":\"How to enrich your CI\/CD pipelines with static code analysis - Proud2beCloud Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.besharp.it\/#website\"},\"datePublished\":\"2021-06-25T11:59:00+00:00\",\"dateModified\":\"2021-06-28T09:56:57+00:00\",\"author\":{\"@id\":\"https:\/\/blog.besharp.it\/#\/schema\/person\/e7262d28e51528c2e420327f9b18cd43\"},\"description\":\"This article will dive deep into Sonarqube and how to integrate it into a continuous delivery pipeline to enrich it with static code analysis\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.besharp.it\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to enrich your CI\/CD pipelines with static code analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.besharp.it\/#website\",\"url\":\"https:\/\/blog.besharp.it\/\",\"name\":\"Proud2beCloud Blog\",\"description\":\"il blog di beSharp\",\"alternateName\":\"Proud2beCloud Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.besharp.it\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.besharp.it\/#\/schema\/person\/e7262d28e51528c2e420327f9b18cd43\",\"name\":\"Alessio Gandini\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.besharp.it\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/eeb98518768d999bff24f8358b464fe2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/eeb98518768d999bff24f8358b464fe2?s=96&d=mm&r=g\",\"caption\":\"Alessio Gandini\"},\"description\":\"Cloud-native Development Line Manager @ beSharp, DevOps Engineer e AWS expert. Computer geek da quando avevo 6 anni, appassionato di informatica ed elettronica a tutto tondo. Ultimamente sto esplorando l'esperienza utente vocale e il mondo dell'IoT. Appassionato di cinema e grande consumatore di serie TV, videogiocatore della domenica.\",\"url\":\"https:\/\/blog.besharp.it\/author\/alessio-gandini\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to enrich your CI\/CD pipelines with static code analysis - Proud2beCloud Blog","description":"This article will dive deep into Sonarqube and how to integrate it into a continuous delivery pipeline to enrich it with static code analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/","og_locale":"en_US","og_type":"article","og_title":"Enriching CI\/CD pipelines with static code analysis using SonarQube","og_description":"Integrating SonarQube into CI\/CD Pipelines to enrich them with static code analysis.","og_url":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/","og_site_name":"Proud2beCloud Blog","article_published_time":"2021-06-25T11:59:00+00:00","article_modified_time":"2021-06-28T09:56:57+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/twitter-shared-link-8.png","type":"image\/png"}],"author":"Alessio Gandini","twitter_card":"summary_large_image","twitter_title":"Enriching CI\/CD pipelines with static code analysis using SonarQube","twitter_description":"Integrating SonarQube into CI\/CD Pipelines to enrich them with static code analysis.","twitter_image":"https:\/\/blog.besharp.it\/wp-content\/uploads\/2021\/06\/twitter-shared-link-8.png","twitter_misc":{"Written by":"Alessio Gandini","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/","url":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/","name":"How to enrich your CI\/CD pipelines with static code analysis - Proud2beCloud Blog","isPartOf":{"@id":"https:\/\/blog.besharp.it\/#website"},"datePublished":"2021-06-25T11:59:00+00:00","dateModified":"2021-06-28T09:56:57+00:00","author":{"@id":"https:\/\/blog.besharp.it\/#\/schema\/person\/e7262d28e51528c2e420327f9b18cd43"},"description":"This article will dive deep into Sonarqube and how to integrate it into a continuous delivery pipeline to enrich it with static code analysis","breadcrumb":{"@id":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.besharp.it\/how-to-enrich-your-ci-cd-pipelines-with-static-code-analysis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.besharp.it\/"},{"@type":"ListItem","position":2,"name":"How to enrich your CI\/CD pipelines with static code analysis"}]},{"@type":"WebSite","@id":"https:\/\/blog.besharp.it\/#website","url":"https:\/\/blog.besharp.it\/","name":"Proud2beCloud Blog","description":"il blog di beSharp","alternateName":"Proud2beCloud Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.besharp.it\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.besharp.it\/#\/schema\/person\/e7262d28e51528c2e420327f9b18cd43","name":"Alessio Gandini","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.besharp.it\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/eeb98518768d999bff24f8358b464fe2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eeb98518768d999bff24f8358b464fe2?s=96&d=mm&r=g","caption":"Alessio Gandini"},"description":"Cloud-native Development Line Manager @ beSharp, DevOps Engineer e AWS expert. Computer geek da quando avevo 6 anni, appassionato di informatica ed elettronica a tutto tondo. Ultimamente sto esplorando l'esperienza utente vocale e il mondo dell'IoT. Appassionato di cinema e grande consumatore di serie TV, videogiocatore della domenica.","url":"https:\/\/blog.besharp.it\/author\/alessio-gandini\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/posts\/3253"}],"collection":[{"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/comments?post=3253"}],"version-history":[{"count":0,"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/posts\/3253\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/media\/3286"}],"wp:attachment":[{"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/media?parent=3253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/categories?post=3253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.besharp.it\/wp-json\/wp\/v2\/tags?post=3253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}