Scanning code along with Docker build, Automated test reports

SonarQube Cloud
, ,
1

Template for a good new topic, formatted with Markdown:

  • ALM used Bitbucket Cloud
  • CI system used Bitbucket Cloud
  • Languages of the repository JS/TS, Python

Issue

The scanning phase is done after the build phase in the official docs, but we directly build Docker images in the Build process of CI.

Can we perform SAST scanning along with the Docker build process, or do we need to perform two separate build steps?

Currently, we don’t make use of any automated tests in our pipeline, so can you please recommend automated tests for JS/TS and Python stacks? Which tools can we make use of in our CI/CD process?

2

Hi,

For JS/TS, Python, you should be able to run the steps in any order. (This is not the case for Java, C#, C, C++ and Objective-C.)

Once you add tests, of course, you’ll want to produce the test report before analysis so you can feed it in.

 
HTH,
Ann