English versionEN

Bring Code Quality and Security to your CI/CD pipeline

Please sign in to watch this workshop.

In this workshop we will go through all the aspects and stages when integrating your project into Code Quality and Security Ecosystem. We will take a simple web-application as a starting point and create a CI pipeline triggering code quality monitoring for it. We will do a full development cycle starting from coding in the IDE and opening a Pull Request and I will show you how you can control the quality at those stages. At the end of the workshop you will be ready to enable such integration for your own projects.

This workshop has been presented at DevOps.js Conf 2022, check out the latest edition of this JavaScript Conference.

FAQ

SonarQube is a self-managed tool that requires you to host it yourself, offering full control over the tool's management and data. SonarCloud, on the other hand, is a cloud-based service hosted by Sonar, requiring no setup for infrastructure, and it's free for open source projects.

Quality Gates are conditions or thresholds set in SonarCloud to determine if a project meets the required standards for code quality and security. If a project passes the Quality Gate, it is considered suitable for deployment; if not, it highlights areas that need improvement before proceeding.

Sonar products, such as SonarCloud, can be integrated into your project's Continuous Integration (CI) pipeline to automate code quality checks, detect bugs, and ensure security compliance. This can be done using tools like GitHub Actions to trigger SonarCloud analyses with each code commit.

SonarCloud automates code quality and security checks, providing detailed reports on bugs, vulnerabilities, code smells, and code coverage. This helps improve code maintainability and reliability, and it supports a wide range of programming languages and integrates with various CI/CD tools.

SonarLint can operate in connected mode with SonarCloud, enabling it to synchronize the rulesets and issues between the IDE and the cloud service. This ensures consistency in code quality checks both locally in the IDE and in the CI/CD pipelines.

Yes, SonarCloud can analyze pull requests and provide feedback on new code changes. It reports issues such as bugs, vulnerabilities, and code smells specifically in the context of the proposed changes, helping to ensure that new contributions do not introduce quality regressions.

SonarLint is an extension for Integrated Development Environments (IDEs) such as VS Code, JetBrains IDEs, Eclipse, and Visual Studio. It provides instant feedback on code quality and potential bugs directly in the IDE, helping developers to identify and fix issues as they code.

code quality ci cd security

Elena Vilchik

76 min

29 Mar, 2022

Comments

Available in other languages:

Watch more workshops on topic

Hands-On Workshop: Introduction to Pentesting for Web Apps / Web APIs

JSNation US 2024

148 min

Hands-On Workshop: Introduction to Pentesting for Web Apps / Web APIs

Featured Workshop

Gregor Biswanger

In this hands-on workshop, you will be equipped with the tools to effectively test the security of web applications. This course is designed for beginners as well as those already familiar with web application security testing who wish to expand their knowledge. In a world where websites play an increasingly central role, ensuring the security of these technologies is crucial. Understanding the attacker's perspective and knowing the appropriate defense mechanisms have become essential skills for IT professionals.This workshop, led by the renowned trainer Gregor Biswanger, will guide you through the use of industry-standard pentesting tools such as Burp Suite, OWASP ZAP, and the professional pentesting framework Metasploit. You will learn how to identify and exploit common vulnerabilities in web applications. Through practical exercises and challenges, you will be able to put your theoretical knowledge into practice and expand it. In this course, you will acquire the fundamental skills necessary to protect your websites from attacks and enhance the security of your systems.

security testing security

0 to Auth in an hour with ReactJS

React Summit 2023

56 min

0 to Auth in an hour with ReactJS

Workshop

Kevin Gao

Passwordless authentication may seem complex, but it is simple to add it to any app using the right tool. There are multiple alternatives that are much better than passwords to identify and authenticate your users - including SSO, SAML, OAuth, Magic Links, One-Time Passwords, and Authenticator Apps.
While addressing security aspects and avoiding common pitfalls, we will enhance a full-stack JS application (Node.js backend + React frontend) to authenticate users with OAuth (social login) and One Time Passwords (email), including:- User authentication - Managing user interactions, returning session / refresh JWTs- Session management and validation - Storing the session securely for subsequent client requests, validating / refreshing sessions- Basic Authorization - extracting and validating claims from the session token JWT and handling authorization in backend flows
At the end of the workshop, we will also touch other approaches of authentication implementation with Descope - using frontend or backend SDKs.

react web development authentication security

OWASP Top Ten Security Vulnerabilities in Node.js

JSNation 2024

97 min

OWASP Top Ten Security Vulnerabilities in Node.js

Workshop

Marco Ippolito

In this workshop, we'll cover the top 10 most common vulnerabilities and critical security risks identified by OWASP, which is a trusted authority in Web Application Security.During the workshop, you will learn how to prevent these vulnerabilities and develop the ability to recognize them in web applications.The workshop includes 10 code challenges that represent each of the OWASP's most common vulnerabilities. There will be given hints to help solve the vulnerabilities and pass the tests.The trainer will also provide detailed explanations, slides, and real-life examples in Node.js to help understand the problems better. Additionally, you'll gain insights from a Node.js Maintainer who will share how they manage security within a large project.It's suitable for Node.js Developers of all skill levels, from beginners to experts, it requires a general knowledge of web application and JavaScript.
Table of contents:- Broken Access Control- Cryptographic Failures- Injection- Insecure Design- Security Misconfiguration- Vulnerable and Outdated Components- Identification and Authentication Failures- Software and Data Integrity Failures- Security Logging and Monitoring Failures- Server-Side Request Forgery

node.js security

Static Web Apps demo – CI/CD, Deployment and Test Pipeline on Azure

TestJS Summit 2021

50 min

Static Web Apps demo – CI/CD, Deployment and Test Pipeline on Azure

Workshop

Juarez Barbosa Junior

A real-world demo and a playground for Azure Static Web Apps service.

azure ci cd testing devops

How to Build Front-End Access Control with NFTs

JSNation 2024

88 min

How to Build Front-End Access Control with NFTs

Workshop

Solange Gueiros

Understand the fundamentals of NFT technology and its application in bolstering web security. Through practical demonstrations and hands-on exercises, attendees will learn how to seamlessly integrate NFT-based access control mechanisms into their front-end development projects.

security

Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk

JSNation 2022

99 min

Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk

Workshop

Matthew Salmon

npm and security, how much do you know about your dependencies?Hack-along, live hacking of a vulnerable Node app https://github.com/snyk-labs/nodejs-goof, Vulnerabilities from both Open source and written code. Encouraged to download the application and hack along with us.Fixing the issues and an introduction to Snyk with a demo.Open questions.

npm node.js javascript security case study

Check out more articles and videos

We constantly think of articles and videos that might spark Git people interest / skill us up or help building a stellar career

It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder

Node Congress 2022

26 min

It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder

Top Content

Feross Aboukhadijeh

Feross is the author and maintainer of WebTorrent, StandardJS, and 100s of other open source projects

The talk discusses the importance of supply chain security in the open source ecosystem, highlighting the risks of relying on open source code without proper code review. It explores the trend of supply chain attacks and the need for a new approach to detect and block malicious dependencies. The talk also introduces Socket, a tool that assesses the security of packages and provides automation and analysis to protect against malware and supply chain attacks. It emphasizes the need to prioritize security in software development and offers insights into potential solutions such as realms and Deno's command line flags.

node.js security

Why is CI so Damn Slow?

DevOps.js Conf 2022

27 min

Why is CI so Damn Slow?

Nicholas Yang

Vercel

Slow CI has a negative impact on productivity and finances. Debugging CI workflows and tool slowness is even worse. Dependencies impact CI and waiting for NPM or YARN is frustrating. The ideal CI job involves native programs for static jobs and lightweight environments for dynamic jobs. Improving formatter performance and linting is a priority. Performance optimization and fast tools are essential for CI and developers using slower hardware.

ci cd devops

The State of Passwordless Auth on the Web

JSNation 2023

30 min

The State of Passwordless Auth on the Web

Phil Nash

DataStax

Passwords are terrible and easily hacked, with most people not using password managers. The credential management API and autocomplete attribute can improve user experience and security. Two-factor authentication enhances security but regresses user experience. Passkeys offer a seamless and secure login experience, but browser support may be limited. Recommendations include detecting Passkey support and offering fallbacks to passwords and two-factor authentication.

authentication security

End the Pain: Rethinking CI for Large Monorepos

DevOps.js Conf 2024

25 min

End the Pain: Rethinking CI for Large Monorepos

Juri Strumpflohner

Nx Core Member

Today's Talk discusses rethinking CI in monorepos, with a focus on leveraging the implicit graph of project dependencies to optimize build times and manage complexity. The use of NX Replay and NX Agents is highlighted as a way to enhance CI efficiency by caching previous computations and distributing tasks across multiple machines. Fine-grained distribution and flakiness detection are discussed as methods to improve distribution efficiency and ensure a clean setup. Enabling distribution with NX Agents simplifies the setup process, and NX Cloud offers dynamic scaling and cost reduction. Overall, the Talk explores strategies to improve the scalability and efficiency of CI pipelines in monorepos.

monorepos ci cd

Atomic Deployment for JS Hipsters

DevOps.js Conf 2024

25 min

Atomic Deployment for JS Hipsters

m4dz

DX Engineer at alwaysdata

This Talk discusses atomic deployment for JavaScript and TypeScript, focusing on automated deployment processes, Git hooks, and using hard links to copy changes. The speaker demonstrates setting up a bare repository, configuring deployment variables, and using the post-receive hook to push changes to production. They also cover environment setup, branch configuration, and the build process. The Talk concludes with tips on real use cases, webhooks, and wrapping the deployment process.

developer experience ci cd automation devops

How to Build CI/CD Pipelines for a Microservices Application

DevOps.js Conf 2021

33 min

How to Build CI/CD Pipelines for a Microservices Application