Scaling Software Quality at Xero with SonarQube Cloud

on YouTube ↗16m

" summary

Xero migrates SonarQube Server to SonarQube Cloud, onboarding about 3,000 repositories in one scripted run and ending with 3,500 repositories live; a mistaken global auto-analysis mishap triggers quick communication but no blocked pipelines; cloud cuts infrastructure maintenance (ECS, DB, backups), centralizes permissions, and delivers GitHub PR feedback plus quality gates. Results: faster onboarding with API scripts, reduced admin sprawl, ongoing rule tuning to lower false positives, and AI-ready code coverage.

AI-written summary · about

" chapters (24)

1. 0:00Introduction
2. 0:30Xero Platform Overview and Speaker Background
3. 1:45Talk Roadmap: From SonarQube Server to Cloud Migration
4. 2:13Early Adoption of SonarQube Server for Code Quality
5. 2:42Security Team Ownership and Platform Changes in 2024
6. 3:10Pain Points: Operational Overhead and Tooling Silos
7. 3:52Adoption Challenges and Configuration Sprawl
8. 4:47Why We Migrated from SonarQube Server to SonarQube Cloud
9. 5:12Concerns About Feature Parity and Platform Needs
10. 5:36Getting Started with SonarQube Cloud in 2025
11. 5:52Building a Cross-Functional Migration and Rollout Team
12. 6:30Beta Teams, Early Feedback, and Documentation Improvements
13. 7:12Auto-Analysis Mishap: Lessons Learned and Recovery
14. 7:55Scaling the Rollout: Onboarding 3,000 Repositories Quickly
15. 8:19Migration Window and Decommissioning SonarQube Server
16. 9:24Benefits: AI-Ready Code Quality Coverage at Scale
17. 10:06Faster Repository Onboarding with Auto Analysis
18. 10:55GitHub Pull Request Feedback and Quality Gates
19. 11:29Stronger Governance with Less Administrative Overhead
20. 12:02Biggest Win: Eliminating Infrastructure Maintenance
21. 12:30Next Steps: Tuning Rules and Reducing False Positives
22. 13:33Using Portfolios for Engineering Leadership Visibility
23. 14:07Developer Onboarding Docs and Permission Syncing
24. 15:01Results: 3,500 Repositories and Higher Code Confidence

" related talks

• 47mRollercoaster of Security AutomationArtem Rozumenko · Selenium Camp 2019
• 26mCase Study of SuccessCamilo Piedrahita · DevOpsDays Bogotá 2022
• 06mWith great AI power comes great responsibilityManish Kapur · Microsoft Build 2024
• 11mLove Your Security Engineer as YourselfAndrey Beshkov · DevOpsDays Moscow 2019
• 40mNo More ‘Someone Else’s Problem’: Tackling Tech Debt at ScaleFlorian Mierzejewski · AndroidMakers by droidcon 2025
• 30mJourney To The CloudEric Labourdette, Vince Stammegna · GitLab Commit San Francisco 2020
• 47mREX QuickSign/Integrating security into a DevOps environment: Mission Impossible?Cédric Picard · DevOps D-Day 2022
• 46mContinuous Delivery On Premise: Gerrit, Jenkins and SonarQube ...Julien Béti, Réda Housni Alaoui · Devoxx France 2022