Roles of Common CI/CD Tools: SonarQube, Trivy/Grype, Nexus/Artifactory, and SAST vs DAST | DevOps, CI/CD & Tooling

Q: What are common mistakes?

WRONG: running only SAST and skipping DAST. SAST finds code patterns but misses runtime configuration issues like a missing auth filter or a misconfigured CORS policy. CORRECT: run both as complementary layers. SAST on every commit, DAST against the deployed test instance. WRONG: overstrict quality

Definition

SonarQube gates code quality, Trivy and Grype scan for known CVEs, Nexus and Artifactory store trusted artifacts, and SAST reads the code while DAST attacks the running app.

SonarQube – static code analysis tool that checks bugs, code smells, security hotspots, and test coverage, enforcing a quality gate that fails the build if thresholds are not met.
Trivy/Grype – vulnerability scanners that compare container images and dependencies against CVE databases and fail the build on high or critical findings.
Nexus/Artifactory – artifact repository managers that store build outputs (JARs, images) with immutable versions and proxy external repositories.
SAST – Static Application Security Testing; analyses source code or bytecode without running it.
DAST – Dynamic Application Security Testing; scans a running application from the outside with real HTTP requests.

Picture the National Bank of India's quality controls for a new cheque-processing machine. SonarQube is the design reviewer who reads the blueprints and rejects them if the wiring is messy. Trivy and Grype are the parts inspectors checking that no component came from a recalled batch. Nexus or Artifactory is the certified warehouse storing every approved machine with a serial number. SAST reads the blueprint before the machine is switched on; DAST switches the machine on and pokes it with test cheques to see how it behaves.

Understanding the Concepts

What does SonarQube do in a pipeline?

SonarQube performs static code analysis. It scans source code for bugs, code smells, duplicated code, and security hotspots. It ingests the JaCoCo coverage report to measure test coverage. The quality gate is a set of conditions that fail the build if thresholds are not met.

BASH

# Run SonarQube analysis after build and test
mvn clean verify sonar:sonar \
  -Dsonar.host.url=https://sonar.bank.local \
  -Dsonar.qualitygate.wait=true
# The build fails if the quality gate is breached:
# - Coverage on new code < 80%
# - New critical issues > 0
# - New security hotspots not reviewed

YAML

# GitHub Actions: SonarQube quality gate
jobs:
  build:
    steps:
      - run: mvn clean verify
      - run: mvn sonar:sonar -Dsonar.qualitygate.wait=true
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      # If quality gate fails, the step exits non-zero and the build fails.

What do Trivy and Grype do?

Trivy and Grype scan container images and dependency manifests against public CVE databases. They report findings by severity and fail the build on high or critical issues.

BASH

# Trivy: scan an image and fail on high/critical CVEs
trivy image --exit-code 1 --severity HIGH,CRITICAL \
  registry.bank.local/transfer-service:abc1234

# Output example:
# Total: 2 (HIGH: 1, CRITICAL: 1)
# +-----------+----------------+----------+-------------------+
# | Library   | Vulnerability  | Severity | Fixed Version     |
# +-----------+----------------+----------+-------------------+
# | log4j-core| CVE-2021-44228 | CRITICAL | 2.17.0            |
# | jackson   | CVE-2022-42003 | HIGH     | 2.14.0            |
# +-----------+----------------+----------+-------------------+

BASH

# Grype: alternative scanner, same purpose
grype registry.bank.local/transfer-service:abc1234 --fail-on high

What do Nexus and Artifactory do?

Nexus and Artifactory serve two purposes. First, they store your build outputs (JARs, container images) as immutable versions. Second, they proxy and cache external repositories so builds pull dependencies through a controlled gateway.

XML

<!-- Maven settings.xml: resolve dependencies through Nexus --syn-kw">>
syn-kw"><settingssyn-kw">>
  syn-kw"><mirrorssyn-kw">>
    syn-kw"><mirrorsyn-kw">>
      syn-kw"><idsyn-kw">>bank-nexussyn-kw"></idsyn-kw">>
      syn-kw"><mirrorOfsyn-kw">>*syn-kw"></mirrorOfsyn-kw">>
      syn-kw"><urlsyn-kw">>https://nexus.bank.local/repository/maven-central/syn-kw"></urlsyn-kw">>
    syn-kw"></mirrorsyn-kw">>
  syn-kw"></mirrorssyn-kw">>
syn-kw"></settingssyn-kw">>

BASH

# Push a build artifact to Nexus
mvn deploy -DaltDeploymentRepository=bank-nexus::https://nexus.bank.local/repository/maven-releases/

# Push an image to Nexus Docker registry
docker push nexus.bank.local:8083/transfer-service:abc1234

Benefits: reproducibility (builds work even if Maven Central is down), speed (cached locally), and governance (banned packages can be blocked at the proxy level).

What is SAST and when does it run?

SAST analyses source code or bytecode without running it. It catches insecure patterns like SQL built by string concatenation, hardcoded secrets, or unsafe deserialization. It runs early in the pipeline on every commit.

JAVA

// SAST finding: SQL injection via string concatenation
// WRONG:
String query = "SELECT * FROM account WHERE id = '" + accountId + "'";
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(query);  // SAST flags this!

// CORRECT: parameterized query
String query = "SELECT * FROM account WHERE id = ?";
PreparedStatement stmt = conn.prepareStatement(query);
stmt.setString(1, accountId);
ResultSet rs = stmt.executeQuery();

BASH

# SonarQube's security rules act as SAST
mvn sonar:sonar
# Flags: sql-injection, hardcoded-credentials, insecure-deserialization

What is DAST and when does it run?

DAST scans a running application from the outside by sending crafted HTTP requests. It finds flaws visible only at runtime, like authentication bypasses, injection that actually reaches the database, or misconfigured headers. It runs after the app is deployed to a test environment.

BASH

# OWASP ZAP: DAST scan against a deployed test instance
zap-cli quick-scan --self-contained \
  --start-options '-config api.disablekey=true' \
  https://transfer-qa.bank.local

# Output: found XSS in /api/search?q=<script>alert(1)</script>
# Output: missing Content-Security-Policy header

How do SAST and DAST compare?

| Aspect | SAST | DAST |
|---|---|---|
| Input | Source code or bytecode | Running application |
| When | Early, on every commit | After deploy to test environment |
| Speed | Fast (no app needed) | Slow (needs running instance) |
| Finds | Code patterns, hardcoded secrets | Runtime injection, auth bypass, headers |
| False positives | Higher (no runtime context) | Lower (real behavior observed) |
| Tools | SonarQube, Checkmarx, Semgrep | OWASP ZAP, Burp Suite |
| Coverage | Your code only | Full stack including config |

What are common mistakes?

BASH

# WRONG: running only SAST and skipping DAST.
# SAST finds code patterns but misses runtime configuration issues
# like a missing auth filter or a misconfigured CORS policy.

# CORRECT: run both as complementary layers.
# SAST on every commit, DAST against the deployed test instance.

BASH

# WRONG: over-strict quality gate that blocks on low-severity noise.
# Developers learn to ignore the gate, defeating its purpose.

# CORRECT: tune severities and require justified suppressions.
# Gate on: zero new critical issues, coverage >= 80% on new code.
# Suppress: with a documented justification and an expiry date.

What should a senior engineer know?

These tools are complementary layers: SAST finds issues in your code, vulnerability scanners find issues in your dependencies, and DAST finds issues that only appear at runtime.
Supply-chain integrity: artifact repository plus scanning plus image signing plus an SBOM together give provenance.
Tune gate strictness: an over-strict gate trains developers to ignore it. Keep gates meaningful.
Manage false positives with justified suppressions that have expiry dates.

BASH

# Senior pattern: full pipeline with all layers
mvn clean verify                                    # Build + Test
mvn sonar:sonar -Dsonar.qualitygate.wait=true       # SAST + Quality Gate
docker build -t $IMAGE .
trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE  # CVE Scan
kubectl apply -f qa/                                # Deploy to QA
zap-cli quick-scan https://transfer-qa.bank.local   # DAST

Visual Overview

DIAGRAM

  Pipeline tool placement:

  Source ──▶ Build ──▶ Test ──▶ SAST ──▶ Package ──▶ CVE Scan ──▶ Deploy ──▶ DAST
                                 │                      │                     │
                            SonarQube              Trivy/Grype           OWASP ZAP
                            Quality Gate           Image scan            Runtime scan
                                 │                      │                     │
                            Fail build             Fail build           Report findings
                            if gate fails          if HIGH/CRIT         for triage

  Artifact flow:

  Build ──▶ Nexus/Artifactory ──▶ QA ──▶ Prod
               │
         Store immutable artifact
         Proxy external deps
         Block banned packages

Key Takeaway

These tools each play a distinct role, and a banking pipeline runs all of them as complementary layers. SonarQube gates code quality by analysing source code for bugs, smells, and security hotspots, and failing the build if coverage or issue thresholds are not met. Trivy and Grype scan container images and dependencies against CVE databases and block severe findings. Nexus and Artifactory store build outputs as immutable versions and proxy external repositories through a controlled, cached gateway.

SAST and DAST find different security flaws at different stages. SAST analyses source code without running it, catching patterns like SQL injection and hardcoded secrets early on every commit. DAST scans a running application with real HTTP requests, finding runtime issues like authentication bypasses and misconfigured headers that only appear when the full stack is up.

The reason to run all of them is coverage. SAST finds issues in your own code, vulnerability scanners find issues in your dependencies, and DAST finds issues that only emerge when the whole system runs together. Together with image signing and an SBOM, they give provable provenance for what runs in production.

Remember one sentence: SonarQube gates your code, Trivy gates your dependencies, Nexus stores your artifacts, and SAST plus DAST together find the security flaws that each one alone would miss.

---