SonarQube on Azure

SonarQube is a SonarSource platform for continuous inspection of code quality to perform automatic reviews with static code analysis to detect various bugs, code smells, and security vulnerabilities on 20+ programming languages.

SonarQube server is available here: Install the Server. SonarSource provides examples using a standard installation with the zip file or Docker container using Docker images.

However, what about hosting SonarQube on Microsoft Azure Cloud? There are at least two possibilities, I tried both:

1. Host SonarQube using Azure AppService (with Docker-Compose), navigate to the manual.
2. Host SonarQube using Azure Virtual Machine (Linux, Nginx, Docker-Compose), navigate to the manual.

Proxy API to SonarQube API

Additionally, a NET 6 application serves as a proxy to SonarQube API. Having man-in-the-middle is to abstract away SonarQube API, so users do not have to query SonarQube API directly using the secret key in the request.

The web application requires Docker, and currently we deploy it to the Azure App Service via CI/CD. Production requires merging a code to the master branch. SonarQube code analysis is trigerred when a code is merged from the custom branch to the development branch (dev).

There are two endpoints:

1. GetMetrics - returns badge from SonarQube server for given project name and metric type. All badges have the same style.
2. GetQualityGate - returns large quality gate badge from SonarQube server for given project name.

List of metric types:

1. bugs
2. code_smells
3. coverage
4. duplicated_lines_density
5. ncloc
6. sqale_rating
7. alert_status
8. reliability_rating
9. security_rating
10. sqale_index
11. vulnerabilities