Integrating SonarQube with Azure Repos to Assess Code Vulnerability for .NET Applications and Send Reports to JFrog Artifactory

Integrating SonarQube with Azure Repos allows you to continuously assess the code quality and security of your .NET applications. This guide will walk you through the steps to set up this integration and send the generated reports to an Artifactory repository.

Prerequisites

Before you begin, ensure you have the following:

• An Azure DevOps account
• A SonarQube server (either locally hosted or on the cloud)
• An Artifactory account
• A .NET application in an Azure Repos repository
• Azure CLI installed
• Docker installed (if using Docker for SonarQube)

Step 1: Set Up SonarQube

• Install SonarQube:

• You can install SonarQube locally using Docker:

docker run -d --name sonarqube -p 9000:9000 sonarqube

• Alternatively, you can set up SonarQube on a cloud service.

• Configure SonarQube:

• Access SonarQube at http://localhost:9000 (or your server’s IP).
• Log in with the default credentials (admin/admin) and change the password.
• Create a new project and generate a project key.

Step 2: Integrate SonarQube with Azure DevOps

• Generate a Personal Access Token (PAT):

• In Azure DevOps, go to your profile and select “Security”.
• Create a new token with the necessary scopes (Code, Build).

• Configure SonarQube for Azure DevOps:

• In SonarQube, navigate to Administration > Configuration > General Settings > DevOps Platform Integrations.
• Select the Azure DevOps tab and add your Azure DevOps organization URL and PAT.

• Install SonarQube Extension in Azure DevOps:

• Go to the Azure DevOps marketplace and install the SonarQube extension.

Step 3: Set Up Azure Pipelines

• Create a New Pipeline:

• In your Azure DevOps project, navigate to Pipelines and create a new pipeline.
• Select your repository and configure the pipeline using the YAML file.

• Configure the Pipeline YAML:

• Add the following stages to your azure-pipelines.yml:

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'
  sonarQubeProjectKey: '<your-sonarqube-project-key>'
  sonarQubeServerUrl: 'http://<your-sonarqube-server-url>'
  sonarQubeToken: '<your-sonarqube-token>'

steps:
- task: UseDotNet@2
  inputs:
    packageType: 'sdk'
    version: '5.x'

- task: DotNetCoreCLI@2
  inputs:
    command: 'restore'
    projects: '**/*.csproj'

- task: DotNetCoreCLI@2
  inputs:
    command: 'build'
    projects: '**/*.csproj'
    arguments: '--configuration $(buildConfiguration)'

- task: SonarQubePrepare@4
  inputs:
    SonarQube: 'SonarQube'
    scannerMode: 'CLI'
    configMode: 'manual'
    cliProjectKey: '$(sonarQubeProjectKey)'
    cliProjectName: '<your-project-name>'
    cliSources: '.'

- task: DotNetCoreCLI@2
  inputs:
    command: 'test'
    projects: '**/*.csproj'
    arguments: '--configuration $(buildConfiguration)'

- task: SonarQubeAnalyze@4

- task: SonarQubePublish@4
  inputs:
    pollingTimeoutSec: '300'

Step 4: Send Reports to Artifactory

• Install JFrog CLI:

• Install JFrog CLI on your build agent:

curl -fL https://getcli.jfrog.io | sh

• Configure Artifactory in the Pipeline:

• Add steps to upload the SonarQube report to Artifactory:

- script: |
    jfrog rt config --url=https://<your-artifactory-url> --user=<your-username> --password=<your-password>
    jfrog rt u sonar-report.zip <your-repo-path>/sonar-report.zip
  displayName: 'Upload SonarQube Report to Artifactory'

• Generate and Upload the Report:

• Ensure the SonarQube report is generated and zipped before uploading:

- script: |
    zip -r sonar-report.zip .scannerwork
  displayName: 'Zip SonarQube Report'

By following these steps, you can integrate SonarQube with Azure Repos to continuously assess the code quality and security of your .NET applications and send the generated reports to Artifactory. This setup ensures that your code remains secure and maintainable, while also providing a centralized location for storing and accessing your reports.

Checkout: 

Setting up SonarQube on Azure Virtual Machine

Setting Up SonarQube on an AWS EC2 Instance