DevOps and CI/CD Maturity in Large-Scale Organizations: A SonarQube and Jenkins Approach

This paper reports on our study of how DevOps in combination with Continuous Integration, Continuous Deployment/Delivery (CI/CD) and the Identity and Governance Administration (IGA) elements present a path to maturity for large scale organizations. We base this on the fact that we may support large scale, standardized and efficient software delivery through the development of strong pillars of the architecture via the use of Jenkins and SonarQube in a targeted way. Also reported is how we used Jenkins as the main orchestration engine for the CI/CD pipeline which includes automation of the build, test, and deploy phases and also report on SonarQube’s role in the continuous analysis of code quality and security. Therefore, besides serving its purpose as an academic endeavor toward integrated policy-enforcing workflow architecture based on architectural blueprints wherein specifically within this workflow architecture SonarQube Quality Gates stop code not meeting set standards right in the pipeline. It takes that idea further into a complete DevSecOps approach by illustrating how one can leverage automation to identify and map resource owners in the cloud and CI/CD pipeline so as to enforce periodic access reviews making sure all users have the appropriate level of access at any given moment. This paper also references previous works on DevOps maturity models in addition to conducting empirical case studies with top industry practitioners as a means of synthesizing the required place of automation, cultural change, and continuous governance for successful applications of the DevOps framework.