DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

HOMEWORK — SonarQube + Trivy + CI Jobs

Project: Restaurant Company
Role: DevOps Engineer

Goal

Today you learned:

Lint
Test concept
SonarQube
Trivy
Quality Gate
Troubleshooting
Parallel Jobs
Dependent Jobs
Enter fullscreen mode Exit fullscreen mode

Your homework is to prove that you understand these concepts and can work with the tools.

Part 1 — Verify SonarQube

Start by checking Docker:

docker ps
Enter fullscreen mode Exit fullscreen mode

If SonarQube is stopped:

docker ps -a
docker start sonarqube
Enter fullscreen mode Exit fullscreen mode

Check:

docker ps
Enter fullscreen mode Exit fullscreen mode

Then:

curl http://localhost:9000
Enter fullscreen mode Exit fullscreen mode

You should confirm that SonarQube responds.

Question: What does successful curl localhost:9000 prove?

Part 2 — Check the SonarQube Project

Open:

http://YOUR-EC2-PUBLIC-IP:9000
Enter fullscreen mode Exit fullscreen mode

Log into SonarQube and find the Restaurant Company project you created in class.

Students should take a screenshot showing the project.

Then answer:

1. What is SonarQube?
2. Is SonarQube the same thing as CI?
3. What is a Quality Gate?
4. Does creating a SonarQube project automatically scan source code?
5. What is SonarScanner used for?
Enter fullscreen mode Exit fullscreen mode

Part 3 — Practice Troubleshooting

Run:

free -h
Enter fullscreen mode Exit fullscreen mode

Then:

docker ps
Enter fullscreen mode Exit fullscreen mode

Then:

docker logs --tail 30 sonarqube
Enter fullscreen mode Exit fullscreen mode

Students must explain:

What is RAM?

What is OOM?

What does exit code 137 usually indicate in the incident
we investigated?

Why did Linux kill the SonarQube Java process?

Why did increasing EC2 memory solve the problem?
Enter fullscreen mode Exit fullscreen mode

Then write this troubleshooting sequence in their own words:

PROBLEM
   ↓
CHECK LOGS
   ↓
FIND EVIDENCE
   ↓
FIND ROOT CAUSE
   ↓
FIX
   ↓
VERIFY
Enter fullscreen mode Exit fullscreen mode

And remember:

CHECK → FIND → FIX → VERIFY
Enter fullscreen mode Exit fullscreen mode

Part 4 — Trivy

Students should explain:

1. What is Trivy?
2. What is a vulnerability?
3. What is CVE?
4. What does severity mean?
5. What are LOW, MEDIUM, HIGH and CRITICAL?
6. What is the difference between the primary roles
   of SonarQube and Trivy?
Enter fullscreen mode Exit fullscreen mode

Don't require them to claim that SonarQube is “only quality” or Trivy is “only security.” Their capabilities can overlap.

A good simple answer is:

SonarQube
→ primarily code quality/static analysis in our pipeline

Trivy
→ security scanning for known vulnerabilities
  and other supported security issues
Enter fullscreen mode Exit fullscreen mode

Part 5 — Design the CI Pipeline

Have students draw this architecture themselves:

                    ┌── LINT ─────────┐
                    │                  │
PULL REQUEST ───────┼── SONARQUBE ─────┼──→ ALL PASS
                    │                  │
                    └── TRIVY ─────────┘
Enter fullscreen mode Exit fullscreen mode

Then answer:

Why can these jobs run in parallel?

Expected concept:

They are independent checks and don't necessarily need the output of each other.

Part 6 — Add a Dependent Job

Now add:

                    ┌── LINT ─────────┐
                    │                  │
PULL REQUEST ───────┼── SONARQUBE ─────┼──→ ALL PASS
                    │                  │
                    └── TRIVY ─────────┘
                                             ↓
                                      ARTIFACT BUILD
Enter fullscreen mode Exit fullscreen mode

Students should write:

needs:
  - lint
  - sonarqube
  - trivy
Enter fullscreen mode Exit fullscreen mode

Then explain:

What does needs mean in GitHub Actions?

Expected:

needs creates a dependency between jobs. The dependent job waits for the required jobs to complete successfully.

Part 7 — Interview Practice

Every student should be able to say this without reading:

In our CI pipeline, we use SonarQube for code-quality analysis and Trivy for security scanning. Independent checks can run in parallel to reduce pipeline time. A later build job can depend on those required checks using needs. We also troubleshot a real SonarQube failure where Linux killed the Java process because the EC2 instance ran out of memory.

Top comments (0)