Ravindra BagaleCourses & study guides मराठी

Chapter 80: DevOps Projects Part 10: Jenkins Agents Freestyle Pipeline Webhook Sonar ECR EKS Approval Libraries Backup

80.5 Project 71: Java Maven build with SonarQube quality gate

By Last updated:

Friends, green tests are not enough. Today we add a SonarQube stage, wait for the quality gate, and fail the pipeline when coverage or smells break the gate.

What you will build in this project

  1. Add Sonar scanner to the Jenkinsfile.
  2. Store the Sonar token in Jenkins credentials.
  3. Wait for quality gate.
  4. Fail the build on ERROR gate.

1. Start from a real company story

At Capgemini in Mumbai, a service with 12 percent coverage shipped and a null path took payments down.

Rough cost: about ₹40 lakh in failed settlements that morning.

Sneha blocked merges on Sonar quality gate ERROR.

Today we wire Maven plus Sonar the same way.

mvn verifytests+coveragesonaranalysisgatewaitForQualityGatefailERROR stops
Picture 1: mvn verify → sonar:sonar → quality gate wait → pass/fail

Ravindra Bagale's Tip

Students disable the gate with sonar.qualitygate.wait=false forever to unblock a release. Fix the findings; do not mute the gate. Keep that habit.

2. Start and prepare

Step 1: Why quality gate

Why: Tests miss smells and coverage gaps. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'SonarQube scores bugs smells coverage security hotspots'

You will see:

SonarQube scores bugs smells coverage security hotspots

What it means: What.

Example 2: a2

Type this:

mkdir -p /tmp/jen71 && echo 'Today: sonar stage, token, waitForQualityGate'

You will see:

Today: sonar stage, token, waitForQualityGate

What it means: Scope.

Example 3: a3

Type this:

echo 'Gate ERROR must fail the pipeline'

You will see:

Gate ERROR must fail the pipeline

What it means: Rule.

Step 2: Sonar server tip

Why: URL and project key. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: notes. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'SONAR_HOST_URL=https://sonar.example.com' 'SONAR_PROJECT_KEY=shop-cart' > /tmp/jen71/SONAR.env && cat /tmp/jen71/SONAR.env

You will see:

SONAR_PROJECT_KEY=shop-cart

What it means: Env.

Example 5: b2

Type this:

echo 'Create the project key once in the Sonar UI'

You will see:

Create the project key once in the Sonar UI

What it means: UI.

Example 6: b3

Type this:

echo 'Use a project token with analysis permission only'

You will see:

Use a project token with analysis permission only

What it means: Least privilege.

Step 3: Credential

Why: Jenkins secret text. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: add credential. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'Manage Jenkins -> Credentials -> Add' 'Kind: Secret text' 'ID: sonar-token' 'Secret: paste Sonar token' > /tmp/jen71/CRED.txt && cat /tmp/jen71/CRED.txt

You will see:

ID: sonar-token

What it means: Cred.

Example 8: c2

Type this:

echo 'Never print the token in sh echo'

You will see:

Never print the token in sh echo

What it means: Mask.

Example 9: c3

Type this:

echo 'Rotate tokens when people leave the project'

You will see:

Rotate tokens when people leave the project

What it means: Rotate.

3. Build the main pieces

Step 4: Jenkinsfile stage

Why: sonar in pipeline. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf stage. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' '    stage(\'Sonar\') {' '      steps {' '        withCredentials([string(credentialsId: \'sonar-token\', variable: \'SONAR_TOKEN\')]) {' '          sh \'mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=shop-cart -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.login=$SONAR_TOKEN\'' '        }' '      }' '    }' > /tmp/jen71/SONAR_STAGE.txt && head -5 /tmp/jen71/SONAR_STAGE.txt

You will see:

stage('Sonar') {

What it means: Stage.

Example 11: d2

Type this:

echo 'Set SONAR_HOST_URL as a job env or folder property'

You will see:

Set SONAR_HOST_URL as a job env or folder property

What it means: Host env.

Example 12: d3

Type this:

echo 'verify runs tests and jacoco before sonar reads coverage'

You will see:

verify runs tests and jacoco before sonar reads coverage

What it means: Order.

Step 5: Quality gate wait

Why: Pipeline pause. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: wait step. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' '    stage(\'Quality Gate\') {' '      steps {' '        timeout(time: 10, unit: \'MINUTES\') {' '          waitForQualityGate abortPipeline: true' '        }' '      }' '    }' > /tmp/jen71/GATE_STAGE.txt && cat /tmp/jen71/GATE_STAGE.txt

You will see:

waitForQualityGate abortPipeline: true

What it means: Gate wait.

Example 14: e2

Type this:

echo 'Sonar plugin must be installed on Jenkins for waitForQualityGate'

You will see:

Sonar plugin must be installed on Jenkins for waitForQualityGate

What it means: Plugin.

Example 15: e3

Type this:

echo 'abortPipeline true turns ERROR into a red build'

You will see:

abortPipeline true turns ERROR into a red build

What it means: Abort.

Step 6: Coverage tool

Why: JaCoCo with Maven. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: pom tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'Add jacoco-maven-plugin prepare-agent and report goals' 'Sonar picks jacoco.xml from target/site/jacoco' > /tmp/jen71/JACOCO.txt && cat /tmp/jen71/JACOCO.txt

You will see:

Sonar picks jacoco.xml from target/site/jacoco

What it means: JaCoCo.

Example 17: f2

Type this:

echo 'Gate often requires coverage greater than 70 percent'

You will see:

Gate often requires coverage greater than 70 percent

What it means: Threshold.

Example 18: f3

Type this:

echo 'Write tests for payment and auth packages first'

You will see:

Write tests for payment and auth packages first

What it means: Priority.

4. Automate and verify

Step 7: Local dry run

Why: mvn sonar tip. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: laptop. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

echo 'mvn -B verify sonar:sonar -Dsonar.host.url=http://localhost:9000 -Dsonar.login=$SONAR_TOKEN'

You will see:

mvn -B verify sonar:sonar -Dsonar.host.url=http://localhost:9000 -Dsonar.login=$SONAR_TOKEN

What it means: Local.

Example 20: g2

Type this:

echo 'Open the project dashboard and read the gate badge'

You will see:

Open the project dashboard and read the gate badge

What it means: UI.

Example 21: g3

Type this:

printf '%s\n' 'Acceptance: gate OK and pipeline green' > /tmp/jen71/ACCEPT.txt && cat /tmp/jen71/ACCEPT.txt

You will see:

Acceptance: gate OK and pipeline green

What it means: Gate file.

Step 8: Fail on purpose

Why: Prove red path. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: lower coverage. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'Comment out CartTest temporarily and rebuild'

You will see:

Comment out CartTest temporarily and rebuild

What it means: Break.

Example 23: h2

Type this:

echo 'Gate should return ERROR and abortPipeline stops later stages'

You will see:

Gate should return ERROR and abortPipeline stops later stages

What it means: Expect.

Example 24: h3

Type this:

echo 'Restore tests before you leave'

You will see:

Restore tests before you leave

What it means: Restore.

Step 9: Folder properties

Why: Share Sonar URL. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: folder config. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'Folder -> Configure -> Properties' 'SONAR_HOST_URL=https://sonar.example.com' > /tmp/jen71/FOLDER.txt && cat /tmp/jen71/FOLDER.txt

You will see:

SONAR_HOST_URL=https://sonar.example.com

What it means: Folder.

Example 26: i2

Type this:

echo 'Child jobs inherit folder env — one place to change'

You will see:

Child jobs inherit folder env — one place to change

What it means: Inherit.

Example 27: i3

Type this:

echo 'Still keep tokens as credentials, not folder plain text'

You will see:

Still keep tokens as credentials, not folder plain text

What it means: Secret.

5. Harden and accept

Step 10: Story Capgemini

Why: Mumbai coverage gap. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'At Capgemini in Mumbai, 12 percent coverage shipped and a null path took payments down.' 'Sneha blocked merges on Sonar quality gate ERROR.' > /tmp/jen71/STORY.txt && wc -l /tmp/jen71/STORY.txt

You will see:

2 /tmp/jen71/STORY.txt

What it means: Story.

Example 29: j2

Type this:

echo 'Rough cost: about ₹40 lakh in failed settlements that morning'

You will see:

Rough cost: about ₹40 lakh in failed settlements that morning

What it means: Cost.

Example 30: j3

Type this:

echo 'Sneha: PASS'

You will see:

Sneha: PASS

What it means: Sign-off.

Step 11: Proof

Why: Stage files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

ls /tmp/jen71

You will see:

ACCEPT.txt\nCRED.txt\nFOLDER.txt\nGATE_STAGE.txt\nJACOCO.txt\nSONAR.env\nSONAR_STAGE.txt\nSTORY.txt

What it means: Tree.

Example 32: k2

Type this:

grep abortPipeline /tmp/jen71/GATE_STAGE.txt

You will see:

waitForQualityGate abortPipeline: true

What it means: Abort line.

Example 33: k3

Type this:

echo 'Next: Docker build and push to ECR project 72'

You will see:

Next: Docker build and push to ECR project 72

What it means: Bridge.

Step 12: Acceptance

Why: Gate blocks bad code. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Sonar stage in Jenkinsfile'

You will see:

Sonar stage in Jenkinsfile

What it means: Stage.

Example 35: z2

Type this:

echo 'waitForQualityGate abortPipeline true'

You will see:

waitForQualityGate abortPipeline true

What it means: Wait.

Example 36: z3

Type this:

echo 'ERROR path proven red'

You will see:

ERROR path proven red

What it means: Fail path.

Check yourself

Q1. Who fixed Capgemini coverage gap?

Sneha

Q2. Tool?

SonarQube

Q3. Gate status bad?

ERROR

Q4. Step name?

waitForQualityGate

Q5. Token store?

credentials

Q6. Mute forever?

no

Friends, you gated Maven with SonarQube. Did you understand? Let us try it once more. Drop coverage below the gate on purpose and prove the pipeline goes red.

Lab: try at home

  1. Add sonar stage.
  2. Bind token credential.
  3. Wait for gate.
  4. Prove ERROR fails build.

Recap

  • Coverage is a gate.
  • Token in credentials.
  • waitForQualityGate.
  • Never mute forever.
  • Fix findings.