AI-Powered Security in GitLab | Sonar Integration Demo
summary
Demo shows Sonar scanning wired into GitLab CI and merge requests so Sonar results appear inline, the security dashboard aggregates findings, and GitLab Ultimate plus Duo agent platform runs AI triage that flags likely false positives and generates AI-generated remediation merge requests which are auto-rescanned. The stack uses GitLab’s eight native scanners alongside Sonar, enforces scans and approvals via policy YAML stored in a security policy project for an auditable change history, and announces Sonar’s GA architecture management capability — all presented as working integrations, not just concepts.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:31GitLab Beyond Source Code Management
- 5:20GitLab Security, Governance, and AI Across the SDLC
- 8:09How GitLab and SonarQube Work Together
- 11:37Demo: SonarQube Findings in GitLab Merge Requests
- 13:38GitLab Vulnerability Dashboards and AI Triage
- 14:53AI Remediation and False-Positive Analysis in GitLab Duo
- 15:57Enforcing SonarQube Scans with GitLab Policies
- 17:30Compliance, Separation of Duties, and Auditability
- 19:19AI’s Long-Term Impact on DevSecOps Workflows
- 22:25Why Verification and Guardrails Matter More Now
- 25:06Closing Thoughts on Secure AI Development
related talks
01mGovAI Summit Spotlight!
11mRealizing DevSecOps with GitLab and Infrastructure as Code
18mUsing AI Across the Dev Lifecycle
17mShift-Left Security in Practice with Gitlab
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
43mSponsored Session: Application Security is a Community Effort
19mApplication Security at High Velocity
24mReinvent your pipeline with GitLab, Kubernetes, and Amazon EKS