-
Technology
-
Industry
-
Solutions
-
- ASSET MANAGEMENT
- CUSTOMER EXPERIENCE MANAGEMENT
- CYBER SECURITY
- DATA CENTER
- DOCUMENT MANAGEMENT
- ELECTRONIC DATA INTERCHANGE
- ENTERPRISE DATA MANAGEMENT
- ENTERPRISE RESOURCE PLANNING
- ENTERPRISE RISK MANAGEMENT
- ENTERPRISE-GRADE WEB DATA SOLUTIONS
- FACILITY MANAGEMENT
- FIELD SERVICE
- IDENTITY AND ACCESS MANAGEMENT
- INFRASTRUCTURE
- IT SERVICE MANAGEMENT
- MANAGED IT SERVICES
- PAYMENT AND CARD
- PROJECT MANAGEMENT
- SOFTWARE TESTING
- STORAGE
- VIDEO SOLUTIONS
- WORKFLOW
-
-
Platforms
-
Functions
- Leadership Perspectives
- Innovation Insights
- Research
- Magazines
- News
- CXO Awards
Andrea Malagodi, CIOSonar, a front-runner in code quality and security solutions, has an answer to this growing problem—Clean as You Code.
Sonar's philosophy centers around integrating its solutions into the development process from its inception. Starting at the integrated development environment (IDE) with SonarLint, and through the CI/CD pipeline with either SonarQube or SonarCloud, the Sonar solutions ensure Clean Code at every step in the workflow.
“We keep the entire coding process clean from the offset to ensure that engineers do not waste time and money trying to maintain poorly written code,” says Andrea Malagodi, CIO.
The prevalence of generative AI coding tools, such as GitHub’s Copilot, increases the risk of encountering production bugs due to poorly written or malicious code. While the large learning models (LLM) leveraged by generative AI may be trained on open-source projects without curation for security or quality, using code generated from these tools can be problematic. This can lead to threats like malicious code injections, underscoring the non-negotiable importance of rigorous code inspection and review processes.
Sonar’s "quality gates" or "tollgates" in SonarCloud and SonarQube prioritize long-term quality to avoid the burden of fixing bugs in legacy code down the line, an essential feature when marshaling resources for a greenfield system or making amendments to preexisting ones. The solutions facilitate adherence to a common set of rules, which includes a library encompassing more than 5,500 rules across over 30 supported languages, including Java, JavaScript, C#, TypeScript, and Python.
When a developer submits a pull or change request for code integration into DevOps platforms like GitHub, GitLab, or Bitbucket, Sonar's scanning engine analyzes the code against predefined rules. This can be done through SonarQube for self-managed installations or SonarCloud as a SaaS solution. SonarCloud provides a more streamlined experience by offering configuration options for integrating with CI/CD pipelines and an ‘automatic analysis’ feature.
The latter simplifies the complex process of setting up CI/ CD pipelines for languages such as C-based projects and allows automatic analyses of code repositories without requiring customers to set up and manage their own CI/CD pipelines.
Notably, this capability extends to challenging languages like C and C++, making it particularly appealing to manufacturing companies that utilize these languages for embedded systems.
When SonarLint is connected with either SonarQube or SonarCloud, the rules configured within these platforms inform SonarLint's behavior, displaying individual configurations and ensuring consistency across team members. Security, performance, maintainability and test coverage; these rules encompass all aspects. If the submitted code fails to meet these standards, Sonar blocks its progression and provides detailed feedback on the problem and the necessary corrections. This feedback mechanism serves as a teaching mechanism, enabling developers to understand why certain aspects of their code require improvement through explanations alongside identified issues, facilitating continuous learning and improvement within the team.
Testimonials from several customers attest to the significance of the Sonar solutions. A prominent financial institution has effectively integrated Sonar into its development process alongside other measures. They've adopted an index-based approach, requiring applications to meet a predetermined quality index number before approval for production release. Sonar plays a pivotal role in determining this index, ensuring deployed applications meet stringent quality standards.
Through strict quality requirements, it mitigates the risk of production failures and issues stemming from hastily developed software. Sonar serves as the linchpin of this quality assurance strategy, acting as the final checkpoint before deployment into production. This comprehensive review ensures consistency and reliability across the institution's software development projects, providing developers with peace of mind.
We keep the entire coding process clean to ensure that engineers do not waste time and money trying to maintain poorly written code from the offset
Experiencing sustained growth, Sonar maintains a global presence focused on meeting customer needs and enhancing usability, ultimately fostering a culture of clean coding and ushering in a new status quo in the digital age.
Sonar Delivers Clean Code Solution SonarQube Through Google Cloud Marketplace
Thursday, June 06, 2024
GENEVA & AUSTIN, Texas: Sonar, the leader in Clean Code solutions, today announced that SonarQube is now available on Google Cloud Marketplace, enabling organizations to accelerate DevOps transformations in the cloud, modernize software development workflows, and deliver higher-quality, secure applications. As companies adopt AI code generation tools, SonarQube ensures that no matter where or how code is developed, it leads to secure, reliable, and maintainable software.
SonarQube’s availability on Google Cloud Marketplace streamlines the process for developers to identify and address potential issues in code early on in the software development lifecycle (SDLC), whether code is human-developed or AI-generated. Developers can now quickly set up SonarQube in their Google Cloud environment to analyze their code quality with simplified billing and scalability that fit their specific needs and budget. Organizations are empowered to accelerate their DevOps transformation initiatives while minimizing risks and ensuring long-term success.
“Bringing SonarQube to Google Cloud Marketplace will help customers quickly deploy, manage, and grow the solution on Google Cloud's trusted, global infrastructure," said Dai Vu, Managing Director, Marketplace & ISV GTM Programs at Google Cloud. “Sonar can now securely scale and support customers on their digital transformation journeys.”
Google Cloud Marketplace lets users quickly deploy functional software packages that run on Google Cloud's infrastructure. Google Cloud Marketplace allows customers to easily start up a familiar software package with services like Compute Engine or Cloud Storage, with no manual configuration required.
Over the last 15 years, Sonar has analyzed more than half a trillion lines of code across all industries and company sizes, resulting in a deep understanding of how code is written and managed. Sonar evaluates code for quality and security issues at two points - in the IDE with SonarLint, and in the Continuous Integration (CI) pipeline, with SonarQube. Sonar’s offering is built on the principles of Clean Code, which is the belief that when code is consistent, intentional, adaptable, and responsible – meaning it is easy to understand and change, operates smoothly at runtime, and contains no technical debt – it results in software that is maintainable, reliable, of quality, and secure.
“Code is one of the most valuable assets in a digital economy. As companies adopt AI and move to the cloud, we want them to continue having seamless access to Sonar’s Clean Code solutions as part of their DevOps environment in the cloud,” said Harry Wang, VP of Strategic Partnerships & Head of Product Marketing at Sonar. “SonarQube availability on Google Cloud Marketplace means that organizations can easily combine Google’s AI capabilities with the familiar Clean Code solution that they trust, to evolve and accelerate software development safely and responsibly.”
SonarQube is an essential tool in the current DevOps toolchain as it reduces issues before they reach production, reduces rollbacks and rework, increases developer velocity, and increases DevOps efficiency and agility. By preventing new issues from entering into production, software becomes easier to maintain and businesses become more competitive, as new features are faster to add.
Key benefits of its availability on Google Cloud Marketplace include:
• Faster Setup: Get up and running with SonarQube quickly and easily, eliminating the need for complex manual installations.
• Seamless Integration: Developers can incorporate SonarQube into their Google Cloud environment with the ease of container deployment on Google Kubernetes Engine (GKE).
• Scalability: Usage of SonarQube can easily scale with Google Cloud’s infrastructure to match evolving needs, no matter the size of the organization or software project.
• Simplified Billing and Cost Effectiveness: Companies can consolidate the purchase of SonarQube with the rest of their cloud spending to achieve better discounts on Google Cloud and reduce administrative overhead.
Company
Sonar
Management
Andrea Malagodi, CIO
Description
Sonar is a software company that offers tools to help developers write Clean Code. Its products integrate within the developer workflow to identify and fix problems in code as it is written.
