hands-on lab

Create a Jenkins CICD Pipeline with SonarQube Integration to perform Static Code Analysis

Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.
Learn and validateUse validations to check your solutions every step of the way.
See resultsTrack your knowledge and monitor your progress.
Lab description

Integrating Jenkins with SonarQube provides you with an automated platform for performing continuous inspection of code for quality and security assurance.

In this lab, you will launch a Jenkins and SonarQube CICD environment using Docker containers on a provided EC2 instance. You will then configure a Jenkins build pipeline to build, compile, and package a sample Java servlet web application. The build pipeline will publish the source code into SonarQube, which in turn will perform a static analysis of the code to detect bugs, code smells, and security vulnerabilities.

This lab is aimed at DevOps and CICD practitioners, and, in particular, build and release engineers interested in managing and configuring Jenkins together with SonarQube to perform automated static code analysis.

Lab Objectives

Upon completion of this lab, you will be able to:

  • Install and configure a Jenkins and SonarQube CICD environment using Docker containers
  • Configure Jenkins with the Gradle plugin to perform the core build and packaging for a sample Java servlet web application
  • Configure Jenkins with the SonarQube Scanner plugin for automated static code analysis
  • Create and set up a Jenkins build pipeline using a Jenkinsfile stored within a GitHub repo
  • Use the SonarQube web application to examine and review the generated static analysis report

Lab Prerequisites

You should:

  • Be comfortable with SSH to remotely administer a Linux-based server
  • Be comfortable with basic Linux administration

Lab Environment

This lab will start with the following AWS resources being provisioned automatically for you:

  • A single EC2 instance, named cicd.platform.instance, which will have a public IP address attached

To achieve the Lab end state, you will be walked through the process of:

  • SSHing into the EC2 instance, named cicd.platform.instance
    • Use Docker Compose to launch the following Docker containers:
      • Jenkins
      • SonarQube
      • Postgres
      • Socat
  • Using a browser, administer and configure Jenkins - installing the required plugins. Connectivity to Jenkins will be done via the cicd.platform.instance Public IP address 
  • Using a browser, administer and configure SonarQube. Connectivity to SonarQube will be done via the cicd.platform.instance Public IP address 
  • Create a Jenkins build pipeline and configure it to build a sample Java servlet web application hosted on GitHub, with the source code later being forwarded into SonarQube for static code analysis
  • Execute the Jenkins build pipeline and confirm that it has completed successfully, forwarding the source code over to SonarQube for static code analysis
  • Confirm that SonarQube has received and performed static code analysis and generated a project report



April 9th, 2024 - Updated Jenkins image version to resolve plugin issues. 

January 18th, 2024 - Updated the lab version of Jenkins to avoid an incompatibility issue during the Jenkins build

June 21st, 2023 - Updated instructions and screenshots to reflect the latest UI

November 28th, 2022 - Updated lab to use EC2 Instance Connect and added check

January 12th, 2022 - Updated the instructions and screenshots to reflect the latest Jenkins UI 

About the author
Jeremy Cook, opens in a new tab
Content Lead Architect
Learning paths

Jeremy is a Content Lead Architect and DevOps SME here at Cloud Academy where he specializes in developing DevOps technical training documentation.

He has a strong background in software engineering, and has been coding with various languages, frameworks, and systems for the past 25+ years. In recent times, Jeremy has been focused on DevOps, Cloud (AWS, Azure, GCP), Security, Kubernetes, and Machine Learning.

Jeremy holds professional certifications for AWS, Azure, GCP, Terraform, Kubernetes (CKA, CKAD, CKS).

Covered topics
Lab steps
Logging In to the Amazon Web Services Console
Connecting to the Amazon Virtual Machine Using EC2 Instance Connect
Launch Jenkins and SonarQube Docker Containers
Login to SonarQube and Generate Security Token
Log in to Jenkins and Complete the Default Installation
Install and Configure SonarQube and Gradle Plugins
Create and Execute Jenkins Pipeline Gradle Job
Review SonarQube Static Analysis Report