Sonarqube integration with Azure Web App and SQL

SonarQube is the standard static code review tool for many languages such as Java and PHP. It can determine the violation of code standards and helps the software development team to abolish bugs.

Introduction:

SonarQube can perform as a multi-dimensional analyst and covers various aspects of code quality like duplicate code, potential bugs, coding standards, keeps code complexity low, and increases coverage by units.

In this article, I am going to share how you can set up Sonarqube using your own docker image in Azure Web App and Azure SQL server.

Azure Web App has various benefits over traditional VM like it is fully containerised, supports high- availability, and there is less overhead of managing the VM.

Note: You can use Azure VM instead of Azure web App but I feel it is really painful to manage it, hence I am going with Web App for my case.

Database: The default SonarQube database is the embedded H2 database, which is provided solely for initial testing. It is neither intended nor supported for production use. You will not be able to upgrade with this database. So it is highly recommended to use any other DB which in our scenario we are using SQL DB as it is cheaper than other DB like Postgres.

There are other options that might seem tempting but didn’t really work for me.

1. Official SonarQube images(using ‘Docker Hub’ with the ‘sonarqube’ image): These don’t work due to limitations of the App Service, and can’t be guaranteed to work in the future.
2. SonarQube Certified by Bitnami: This only supports PostgreSQL databases which are very expensive than the standard SQL Server.

Let’s begin with the Setup after all this discussion.

Description

Below are the steps which we are going to follow in order to do the setup.

Step1. Create a Docker Image.

Note: If you want to use another image of Sonarqube, please make the necessary changes in sonarqube.properties file.

Create two files ‘dockerfile’ and ‘sonarqube.properties’ as below:

dockerfile:

FROM sonarqube:8.3-community
COPY sonarqube.properties /opt/sonarqube/conf/sonar.properties

sonarqube.properties :

sonar.search.javaAdditionalOpts=-Dnode.store.allow_mmapfs=false

Step2: Build and push the image to the Azure Container repository(ACR)/docker hub.

Docker login <<your-azure-repo>>
docker build -t <<your-azure-repo>>/sonarqube:v1
docker push

Step3: Create a Web App and SQL Database. Use below configurations:

• App Service Plan — Linux B2 or greater
• SQL Server + Database — Basic (5 DTU) with 2GB storage is fine
• Web App — using a default image for the initial setup.

Step4: SQL Database creation and Configuration:

Create a SQL Database with “SQL_Latin1_General_CP1_CS_AS” collation naming “databasename.database.windows.net” with admin username and password.

Now login to this new DB with admin credentials and create a login:

Log in to your server’s ‘master’ database using SSMS, and run :

CREATE LOGIN sonarqube WITH PASSWORD = ‘StrongPassword’;

Then log in to the database you created (or open the Query Editor in Azure Portal) and run:

ALTER DATABASE sonarqube SET READ_COMMITTED_SNAPSHOT ON WITH ROLLBACK IMMEDIATE;
CREATE USER sonarqube FOR LOGIN SonarQube WITH DEFAULT_SCHEMA = dbo;
ALTER ROLE db_owner ADD MEMBER sonarqube;

Step5: Web APP Container Configuration:

Create a Web App where you choose Docker Compose as Container settings and add the below file in it.

Docker Compose file:

version: “3.3”
services:
sonarqube:
image: sonar.azurecr.io/sonar:v1
ports:
- “9000:9000”
environment:
- SONAR_JDBC_USERNAME=sonarqube
- SONAR_JDBC_PASSWORD=StrongPassword

Step6: Restart the Web App and verify the Sonarqube portal through the app URL.

Step 7: Setup in Sonarqube:

1. Login into the Sonarqube portal and create a new project.
2. Generate a token from the Security tab.
3. Go to Azure DevOps and create a Service Connection with the above-created token.

Add below four tasks in your Build pipeline:

1. Prepare Sonarqube task wherein choose below properties:

ScannerMode: cli
configMode: Manual
cliProjectKey: ProjectNameInSonarqube
Clisources: ‘./’

2. Run the Sonarqube Analysis task and add a property

“continueOnError: True”

3. Publish Code Coverage Result task using tool Cobertura

4. Publish Sonarqube Code

5. Now check the Sonarqube Portal and click on the project you created. You should be able to see the analysis as per the below screenshot.

Conclusion

If everything works for you till here, you can implement the same in multiple build pipelines. This article was a quick introduction to walk through a simple setup. There are many facets of SonarQube that we did not cover here, you may want to look into the documentation on the official Sonarqube page to explore other options as per your requirements.