Forum Discussion

giulio-diluca's avatar
giulio-diluca
Icon for Helper I rankHelper I
1 year ago
Solved

Fabric - Sonar Scan

Hello, In our organization we use Fabric and we have following environments: DEV, TEST, PREPROD, PROD. In DEV and TEST we are integrated with Git, so we have a repository with data pipelines, not...
cicd
security
  • rohit1991's avatar
    rohit1991
    1 year ago

    Hi giulio-diluca 

     

     

    1.Python Notebooks:

    • If your Fabric notebooks use Python, SonarQube can scan them like normal .py files.

    • Export notebooks from Fabric to Git before scanning.

    2.Data Pipelines (JSON):

    • Pipelines are saved as JSON in Git.

    • Sonar can read JSON but only checks structure ,it can’t validate pipeline logic.

    3.SQL Scripts:

    • Sonar supports T-SQL and other SQL code, so you can scan Fabric SQL scripts for best practices and syntax issues.

    4.Other Fabric Items:

    • Dataflows, Lakehouses, and Datasets are metadata-based ,Sonar can’t analyze them yet.

    5.CI/CD Integration:

    • You can run Sonar scans automatically in your Azure DevOps or GitHub pipeline after every commit.

    Conclusion:

    SonarQube works well for Python notebooks and SQL scripts, gives limited checks for JSON pipelines, and doesn’t yet support Lakehouse or Dataflows.Integrating it with your Fabric Git repo is the best way to maintain consistent code quality and CI/CD governance. 

     

rohit1991's avatar
rohit1991
Icon for Super User rankSuper User
1 year ago

Hi giulio-diluca 

 

 

1.Python Notebooks:

  • If your Fabric notebooks use Python, SonarQube can scan them like normal .py files.

  • Export notebooks from Fabric to Git before scanning.

2.Data Pipelines (JSON):

  • Pipelines are saved as JSON in Git.

  • Sonar can read JSON but only checks structure ,it can’t validate pipeline logic.

3.SQL Scripts:

  • Sonar supports T-SQL and other SQL code, so you can scan Fabric SQL scripts for best practices and syntax issues.

4.Other Fabric Items:

  • Dataflows, Lakehouses, and Datasets are metadata-based ,Sonar can’t analyze them yet.

5.CI/CD Integration:

  • You can run Sonar scans automatically in your Azure DevOps or GitHub pipeline after every commit.

Conclusion:

SonarQube works well for Python notebooks and SQL scripts, gives limited checks for JSON pipelines, and doesn’t yet support Lakehouse or Dataflows.Integrating it with your Fabric Git repo is the best way to maintain consistent code quality and CI/CD governance.