Goals

• Install and run SonarQube locally or on a server.

Setup Options

• Docker (Quick)
• Manual (Ubuntu Server)

Outcome

• Running SonarQube dashboard accessible via browser.

Goals

• Analyze your first project using the SonarQube Scanner.

Topics

• SonarScanner CLI
• SonarScanner for Maven or Gradle
• IDE plugins (SonarLint for VSCode, IntelliJ)

Lab

• Analyze a Java/Python/Node.js repo using SonarScanner
• View metrics in dashboard: bugs, coverage, code smells

Goals

• Automate SonarQube analysis in your Jenkins/GitHub Actions pipeline.

Jenkins Integration

• Install SonarQube plugin in Jenkins
• Add SonarQube server config in Jenkins global settings

GitHub Actions

• Outcome: Automatic scan runs on every PR/commit, and results are visible in SonarQube or SonarCloud.

Goals

• Learn how to interpret and act on the analysis results.

Topics

• Quality Gates and Quality Profiles
• Rules (SAST, Clean Code, OWASP, CWE mappings)
• Coverage reports from tools like jacoco, pytest-cov, nyc
• Technical Debt Ratio and Maintainability Index

Tools

• Customize a Quality Gate (e.g., no new bugs, >80% test coverage)
• Configure and apply a Quality Profile per project or language
• Fail builds that don't meet gate

Goal:

• Implement DevSecOps using SonarQube and improve security posture.

Topics

• OWASP Top 10 detection
• SAST capabilities in SonarQube
• Project permissions and roles
• Branch analysis and PR decoration

Lab

• Enable PR analysis via GitHub or Bitbucket
• Scan a repo with known security issues and examine vulnerabilities

Best Edition:

• Best if you're using SonarQube Developer/Enterprise Editions

Topics

• Multi-language analysis (Java, Python, JS, C#, Go, etc.)
• Monorepo support
• Portfolio dashboards and Governance
• Integration with LDAP, SAML, or Azure AD
• Database integration (Postgres/MySQL for persistence)