AZ-400: Built & pushed an artifact in 30 minutes, but spent 2 hours setting up SonarQube

I set out to practice GitHub Actions by integrating SonarQube into a pipeline.

In theory, it should be "just add a task," but in practice the SonarScanner for .NET added a few unexpected quirks:

• host-URL validation,
• version-specific behavior,
• global-tool install issues,
• and confusing error messages around credentials and URLs.

Pipeline setup took about 30 minutes, but making SonarQube actually work reliably in CI took me more than 1.5–2 hours of debugging, version switching, and lots of trial-and-error. In the end, I decided to pin an older version of the SonarScanner for .NET.

What I did step-by-step:

• Created a free SonarCloud account and set up the project.
• Generated a project token in SonarCloud.
• Added the token as a GitHub secret (SONAR_TOKEN).
• Installed the SonarScanner for .NET in GitHub Actions (pinned to an older version).
• Configured dotnet-sonarscanner begin and end with sonar.host.url, project key, and token, making sure credentials are passed in both steps.

The quirks I ran into were mainly with the SonarScanner for .NET and its behavior in CI, not with the free SonarCloud plan itself.

On the other hand, the GitHub Packages integration was easy:

• I used the automatic GITHUB_TOKEN to publish the artifact.
• Went to the artifact repo settings and:
  1. Added myself as admin (Package Settings → Manage Access)
  2. Linked the code repo (Pick the repositories that can access this package)

Edit: 5 minutes later, I now also have Dependabot and CodeQL in the same repo working!

• Dependabot started scanning dependencies for vulnerabilities and potential updates.
• CodeQL performed a security-oriented scan and came back with no issues in the code.

It was very easy to enable this GitHub "built-in" security just by flipping some switches.

If you'd like, I'm happy to share the final GitHub Actions YAML snippet in the comments or on my GitHub repo.