Administering quality gates in SonarQube

(music) (pulse) (chime) Welcome! Quality gates in SonarQube help enforce your code quality and security standards, ensuring only clean, reliable code gets released. In this video, you'll learn what a quality gate is, how to create your own, set one as the default, and associate one with a project in SonarQube. Let's get started. So, what are quality gates? Quality gates act as checkpoints that ensure your code meets defined standards and conditions before it’s released, preventing new issues from entering your main codebase. Each quality gate uses SonarQube metrics like Security, Reliability, Maintainability, and Code Coverage. Your project's quality gate clearly shows a passed or failed status, giving you an instant snapshot of your branch, and merge or pull requests' code health. Use this status to decide if the code is ready to be released. Since the built-in Sonar way quality gate cannot be changed, you can create a custom quality gate to adjust the conditions to meet the needs of your project or organization. To create or manage a custom quality gate and to assign them to your projects, you need the Administer Quality Gates global permission. You can verify this by checking Administration> Security> Global Permissions in SonarQube Server or in Administration> Permissions in SonarQube Cloud to see whether the permission is enabled for your user or group. Quality gates function the same in both SonarQube Server and SonarQube Cloud; only the user interfaces differ slightly. Let's go into the Quality Gates tab to explore how you can create and manage them. Click Create to begin. Once you name the new quality gate, click Save to generate it. You can easily modify or delete them to fit your needs. For example, let's make the New Code Coverage condition more strict. Click the pencil icon change the value to 85%, then click Update Condition. Next, let's add a condition for Overall Code. Select On Overall Code. Search for Security Rating and set its value to A. This ensures your overall code must have an A security rating, or zero vulnerability, to pass the quality gate. Click Add Condition to confirm. These conditions are now active in your custom quality gate. You can easily adjust their thresholds or remove them, if needed. Now, let’s look at how to associate a specific quality gate with a project. Locate the Projects section of the quality gate. You can filter the project list using the Search field or by selecting a tab. For instance, to apply this quality gate to all projects, select the All tab. You can select all projects or select the specific projects where you want this quality gate to be active. Your quality gate is now assigned to the relevant projects. Note that this custom quality gate will take effect with the project’s next analysis run. Finally, let’s review a few best practices for managing quality gates. Prioritize new code. Focus conditions on new code to empower developers to maintain code quality standards on any new code created. Keep gates simple. Start with a few critical conditions and only add more as needed to avoid overwhelming teams. Set a default gate. Make your customized quality gate the default for your organization to standardize all new projects. And, review regularly. Review regularly. Periodically review and adjust quality gate conditions with your teams to ensure they remain relevant and effective. By applying these best practices, you can effectively enforce your organization's code quality and security standards, ensuring cleaner, more reliable code. And, that's a wrap! See our additional videos to dive deeper into Sonar topics!