CI SAST Scanning with Azure DevOps and SonarQube

Based on the Qiita article, this post outlines how to automatically analyze Azure DevOps (ADO) pull requests with SonarQube Server (SQS). The goal is to run SAST when a PR is created and surface the analysis results in the PR.

Connect SonarQube and Azure DevOps

The integration requires the ADO URL and a Personal Access Token (PAT). Create a SonarQube project from the ADO repository, then register the ADO integration in SonarQube.

Configure Azure DevOps

Install the SonarQube app in ADO and create a Service Connection to SonarQube. Use that connection in a Pipeline. The example below analyzes PRs and the master branch:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

trigger:
- master

pr:
- '*'

pool:
  vmImage: ubuntu-latest

steps:
- checkout: self
  fetchDepth: 0
- task: SonarQubePrepare@8
  inputs:
    SonarQube: 'SonarQubeNgrok'
    scannerMode: 'cli'
    configMode: 'manual'
    cliProjectKey: 'wenhan-Sonar_xxxxx'
    cliSources: '.'
- task: SonarQubeAnalyze@8
  inputs:
    jdkversion: 'JAVA_HOME_21_X64'
- task: SonarQubePublish@8
  inputs:
    pollingTimeoutSec: '300'

Set SonarQube to the name of your Service Connection and replace cliProjectKey with the SQS project key.

Add a Branch Policy and verify a PR

Set the target Pipeline as a required check in the ADO Branch Policy. Modify sample code and create a PR. Confirm that the Pipeline sends its analysis to SonarQube and that the PR displays the Quality Gate result and issue details.

This setup runs analysis automatically for each PR and makes the results available during review.