Development teams must balance security and compliance constraints with rapid code deployments. Cloud native technologies introduce many new attack planes and vulnerabilities that traditional security practices struggle to address. Pre-deployment, monolithic scans can take hours only to return a hopelessly long list of issues littered with false positives.
To address these challenges, Sonar and HashiCorp have joined forces to provide DevOps teams with self-service tools that automate code quality checks and simplify the code revision process. HashiCorp provides infrastructure automation software for multi-cloud environments. As a new member of HashiCorp’s Partner Network, Sonar built a tight integration with Terraform Cloud to ensure clean code delivery.
The SonarCloud Run Task integration automatically analyzes pull requests and decorates the TFC pipeline with a Sonar Quality Gate. If it’s green, merge with confidence. A red gate is a blocker and clearly lets you know there are some issues to fix.
The SonarCloud Run Task integration incorporates the Sonar Clean as You Code methodology to ensure DevOps teams catch issues with their HCL sooner rather than later. The Clean as You Code approach enables developers and organizations to optimize the quality of their codebase by focusing on code that's added or changed. This simple yet powerful methodology progressively improves the overall quality of the entire codebase with minimal cost and effort. When teams dedicate less time to addressing old issues or reworking newly created issues, they can accelerate new features, avoid unnecessary rework costs, and foster talent growth and retention.
Failed Sonar Quality Gate in SonarCloud Run Task
This integration brings a lot of benefits to individual developers and their teams so they can consistently deliver clean Terraform projects.
Merge Clean Code
SonarCloud can automatically analyze pull requests and return a Pass/Fail Sonar Quality Gate. It provides you with a clear indicator letting you instantly know if your code is safe to merge. Green means go ahead!
Practice Proactive Security
SonarCloud embodies the Clean as You Code methodology enabling your team to truly shift vulnerability detection to the left without workflow disruption or DevOps re-tooling. With developers helping to shoulder the vulnerability detection workload, valuable DevSecOps staff is now freed to focus on other, underserved security-challenged areas of the business.
Experiment & Grow
It takes time to learn new technologies, especially security best practices. This shouldn’t stop you from exploring and learning about Terraform. On the contrary, with Sonar in your corner, you can really dive in knowing that SonarCloud is a tireless mentor that loves to help you learn from your mistakes.
In addition to keeping your Terraform code clean, SonarCloud supports more than 30 popular and classic languages, frameworks and technologies. SonarCloud is the only tool you need to keep your cloud native infrastructure and applications free from vulnerabilities and code quality issues.
Since its launch in 2018, SonarCloud has helped clean over 2.5 billion lines of code. Over 100,000 users rely on SonarCloud to ensure they only merge Clean Code into their projects. SonarCloud is free to use on open-source projects. To learn more about SonarCloud, visit here.
Clean Terraform Code for the Win!
Join the Clean Code movement, be intentional with the quality of your Terraform code and take pride in delivering cloud native apps in a safe, sustainable way.
Thanks for reading and happy, clean, cloud native coding!
Pick a topic to discover more:
How Bad Code Destroys Developer Velocity
Your Guide to Clean Code in Cloud Native Apps
Level Up Your Team’s Skills as They Code