Forum Discussion

giulio-diluca's avatar
giulio-diluca
Helper I
10 months ago
Solved

Fabric - Sonar Scan

Hello,

In our organization we use Fabric and we have following environments: DEV, TEST, PREPROD, PROD.
In DEV and TEST we are integrated with Git, so we have a repository with data pipelines, notebooks ...
I was thinking about which possibilities there are for Fabric items in Git to be scanned.
I know that probably a notebook written in Python can be scanned in Sonar, then Data Pipelines are json files so maybe yes ... what else? There is some feasability on do that?

Regards

CICD
security
  • rohit1991's avatar
    rohit1991
    10 months ago

    Hi giulio-diluca 

     

     

    1.Python Notebooks:

    • If your Fabric notebooks use Python, SonarQube can scan them like normal .py files.

    • Export notebooks from Fabric to Git before scanning.

    2.Data Pipelines (JSON):

    • Pipelines are saved as JSON in Git.

    • Sonar can read JSON but only checks structure ,it can’t validate pipeline logic.

    3.SQL Scripts:

    • Sonar supports T-SQL and other SQL code, so you can scan Fabric SQL scripts for best practices and syntax issues.

    4.Other Fabric Items:

    • Dataflows, Lakehouses, and Datasets are metadata-based ,Sonar can’t analyze them yet.

    5.CI/CD Integration:

    • You can run Sonar scans automatically in your Azure DevOps or GitHub pipeline after every commit.

    Conclusion:

    SonarQube works well for Python notebooks and SQL scripts, gives limited checks for JSON pipelines, and doesn’t yet support Lakehouse or Dataflows.Integrating it with your Fabric Git repo is the best way to maintain consistent code quality and CI/CD governance. 

     

3 Replies

  • rohit1991's avatar
    rohit1991
    Super User
    10 months ago

    Hi giulio-diluca 

     

     

    1.Python Notebooks:

    • If your Fabric notebooks use Python, SonarQube can scan them like normal .py files.

    • Export notebooks from Fabric to Git before scanning.

    2.Data Pipelines (JSON):

    • Pipelines are saved as JSON in Git.

    • Sonar can read JSON but only checks structure ,it can’t validate pipeline logic.

    3.SQL Scripts:

    • Sonar supports T-SQL and other SQL code, so you can scan Fabric SQL scripts for best practices and syntax issues.

    4.Other Fabric Items:

    • Dataflows, Lakehouses, and Datasets are metadata-based ,Sonar can’t analyze them yet.

    5.CI/CD Integration:

    • You can run Sonar scans automatically in your Azure DevOps or GitHub pipeline after every commit.

    Conclusion:

    SonarQube works well for Python notebooks and SQL scripts, gives limited checks for JSON pipelines, and doesn’t yet support Lakehouse or Dataflows.Integrating it with your Fabric Git repo is the best way to maintain consistent code quality and CI/CD governance.