DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

HOMEWORK — SonarQube Real Analysis

Project: Restaurant Company
Topic: Token → SonarScanner → Analysis → SonarQube Dashboard

Part 1 — Verify SonarQube connectivity

From your Restaurant Company EC2, run:

cd ~/restaurant-company

curl -I http://YOUR-SONARQUBE-IP:9000
Enter fullscreen mode Exit fullscreen mode

Take a screenshot showing the HTTP response.

Answer in your own words:

What does HTTP 200 prove?
Enter fullscreen mode Exit fullscreen mode

Expected concept: the EC2 can communicate with the SonarQube Server on port 9000.

Part 2 — Explain the configuration

Run:

cat sonar-project.properties
Enter fullscreen mode Exit fullscreen mode

Your file should look similar to:

sonar.projectKey=restaurant-company
sonar.projectName=Restaurant Company
sonar.sources=src
sonar.sourceEncoding=UTF-8
Enter fullscreen mode Exit fullscreen mode

Explain each property in one sentence:

sonar.projectKey =
sonar.projectName =
sonar.sources =
sonar.sourceEncoding =
Enter fullscreen mode Exit fullscreen mode

Part 3 — SonarQube vs SonarScanner

Students must draw this architecture:

Restaurant Company
Source Code
       ↓
SonarScanner
       ↓
Analysis Report
       ↓
SonarQube Server :9000
       ↓
Restaurant Company Dashboard
       ↓
Quality Gate
Enter fullscreen mode Exit fullscreen mode

Then answer:

1. What is SonarQube?
2. What is SonarScanner?
3. Why do we need both?
Enter fullscreen mode Exit fullscreen mode

Part 4 — Token

Answer:

1. What is SONAR_TOKEN?
2. Why does SonarScanner need it?
3. Why should we never commit a real token to GitHub?
4. What is authentication?
Enter fullscreen mode Exit fullscreen mode

Do not submit a screenshot containing the real token.

Students can verify that the variable exists without displaying the secret:

test -n "$SONAR_TOKEN" && echo "TOKEN IS SET"
Enter fullscreen mode Exit fullscreen mode

Part 5 — Run the SonarQube analysis

From:

cd ~/restaurant-company
Enter fullscreen mode Exit fullscreen mode

Run the same SonarScanner command used in class.

The student should find these messages:

Analysis report generated
Analysis report compressed
Analysis report uploaded

ANALYSIS SUCCESSFUL

SonarScanner Engine completed successfully

EXECUTION SUCCESS
Enter fullscreen mode Exit fullscreen mode

Take a screenshot showing:

ANALYSIS SUCCESSFUL
Enter fullscreen mode Exit fullscreen mode

Then explain:

What happened between starting SonarScanner
and seeing ANALYSIS SUCCESSFUL?
Enter fullscreen mode Exit fullscreen mode

Expected flow:

READ SOURCE
    ↓
ANALYZE
    ↓
GENERATE REPORT
    ↓
COMPRESS REPORT
    ↓
UPLOAD REPORT
    ↓
SONARQUBE PROCESSES REPORT
Enter fullscreen mode Exit fullscreen mode

Part 6 — SCM and Git

Find this part of the scanner output:

SCM Publisher
Enter fullscreen mode Exit fullscreen mode

Answer:

1. What does SCM stand for?
2. Which SCM are we using?
3. What is a Git revision/commit ID?
4. Why is connecting an analysis to a Git revision useful?
Enter fullscreen mode Exit fullscreen mode

Part 7 — SonarQube Dashboard

Open the Restaurant Company dashboard.

Take one screenshot of the dashboard.

Record what your current dashboard shows:

Quality Gate:
Security:
Reliability:
Maintainability:
Coverage:
Duplications:
Lines of Code:
Languages:
Enter fullscreen mode Exit fullscreen mode

Your results may differ from another student's results.

Then answer:

Does Quality Gate PASSED mean there are zero issues?
Enter fullscreen mode Exit fullscreen mode

Explain why.

Part 8 — Explain the metrics

Write one or two sentences explaining each:

Quality Gate
Security
Reliability
Maintainability
Security Hotspot
Coverage
Duplications
Lines of Code
Enter fullscreen mode Exit fullscreen mode

Important:

PASSED ≠ PERFECT CODE
Enter fullscreen mode Exit fullscreen mode

A Quality Gate can pass while SonarQube still reports issues because the gate evaluates its configured conditions.

Part 9 — Explain our 0% Coverage

Answer:

Why did our SonarQube dashboard show 0.0% Coverage?

Does SonarQube automatically create unit tests?

Where does Coverage data normally come from?
Enter fullscreen mode Exit fullscreen mode

Draw:

TESTS
  ↓
COVERAGE TOOL
  ↓
COVERAGE REPORT
  ↓
SONARQUBE
  ↓
COVERAGE %
Enter fullscreen mode Exit fullscreen mode

Part 10 — Interview Practice

Students should be able to say this without reading:

In our project, we use SonarScanner to analyze the Restaurant Company source code and submit the analysis to SonarQube. SonarQube processes and displays the results, including security, reliability, maintainability, coverage, duplications, and the Quality Gate. We use a token to authenticate the scanner to the SonarQube Server. A passed Quality Gate does not necessarily mean that the code has zero issues.

Top comments (0)