SonarQube for Secure SDLC and Azure DevOps Training Course

1. Concepts and Scope of Static Code Analysis

• Key definitions: static analysis, SAST, rule categories, and severity levels
• The role of static analysis within the secure SDLC and its coverage of risk areas
• Positioning SonarQube within security controls and everyday developer workflows

2. SonarQube Overview: Features and Architecture

• Core services, database structures, and scanner components
• Best practices for Quality Gates, Quality Profiles, and governance
• Security-focused capabilities: vulnerability detection, SAST rules, and CWE mapping

3. Navigating the SonarQube Server Interface

• A guided tour of the server UI: projects, issues, rules, metrics, and governance views
• Interpreting issue pages, tracing code origin, and following remediation guidance
• Generating and exporting reports for stakeholder review

4. Configuring SonarScanner with Build Tools

• Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild
• Best practices for managing scanner properties, exclusions, and multi-module projects
• Generating comprehensive test data and coverage reports to ensure analysis accuracy

5. Integration with Azure DevOps

• Establishing SonarQube service connections within Azure DevOps
• Incorporating SonarQube tasks into Azure Pipelines and configuring PR decoration
• Importing Azure Repos into SonarQube to automate continuous analysis

6. Project Configuration and Third-Party Analyzers

• Selecting project-level Quality Profiles and rules specifically for Java and Angular
• Managing third-party analyzers and understanding the plugin lifecycle
• Defining analysis parameters and managing parameter inheritance

7. Roles, Responsibilities, and Secure Development Methodology

• Defining clear segregation of duties: developers, reviewers, DevOps engineers, and security owners
• Developing a roles and responsibilities matrix for CI/CD processes
• Reviewing existing secure development methodologies and formulating recommendations

8. Advanced Topics: Rules, Tuning, and Global Security Enhancements

• Utilising the SonarQube Web API to create and manage custom rules
• Adjusting Quality Gates and enforcing automated policies
• Hardening SonarQube server security and implementing access control best practices

9. Applied Hands-on Lab Sessions

• Lab A: Configuring SonarScanner for five Java repositories (including Quarkus where relevant) and analysing results
• Lab B: Setting up Sonar analysis for an Angular front-end project and interpreting findings
• Lab C: End-to-end pipeline integration—embedding SonarQube into an Azure DevOps pipeline with PR decoration enabled

10. Testing, Troubleshooting, and Report Interpretation

• Strategies for effective test data generation and coverage measurement
• Addressing common issues related to scanners, pipeline failures, and permission errors
• Techniques for reading and presenting SonarQube reports to both technical and non-technical stakeholders

11. Best Practices and Recommendations

• Selecting rule sets and implementing incremental enforcement strategies
• Workflow recommendations for developers, code reviewers, and build pipelines
• Strategies for scaling SonarQube deployment in enterprise environments

Summary and Next Steps