Do I have to build my repo to use SonarCloud?

SonarQube Cloud
1

I’m getting started with SonarCloud. I have an older .Net Framework 4.8 app with a repo in Azure Devops. I read the instructions for how to setup my YAML pipeline.

The instructions then say to run tasks in this order: Nuget restore, SonarCloudPrepare, VSBuild, SonarCloudAnalyze, SonarCloudPublish.

Is the build necessary to do a static code analysis? Currently in our pipeline we have two stages with SonarCloud being done in stage 1. Stage 2 is build, create artifact, and deploy if desired. This incurs two builds, which for this repo is slow due to size. This repo has no unit tests.

Should I re-organize this pipeline so there need only be one build step?

2

Hi! Welcome to the community!

Yes, you must build your repo in order to analyze your code. .NET scanner uses the Microsoft Roslyn compiler to perform the analysis, so it is a must.

I don’t recommend to use the same build for SonarCloud analysis and the deployment, since SonarCloud build may require a debug build instead of the release build that goes to production.

Best regards.