Local development

Pipeline checks should be reproducible on a developer’s machine. Running checks locally provides several benefits:

Faster feedback: Identify issues quicker than waiting for a CI run.
Higher productivity: Iterate quickly without repeatedly committing changes to trigger pipelines.
Greater confidence: Validate changes before opening a pull request.

What should be runnable locally

As a minimum, developers should be able to run:

Linting and formatting
Static analysis
Security scans
Dependency checks
Terraform validation
Build/package steps
Unit tests
Integration tests (where practical)

How to run locally

Use the examples below to run the same types of checks locally before opening a PR.

Stack	Build/package steps	Unit tests	Linting and formatting	Static analysis	Security and dependency checks
Node.js	Follow the instructions in the Express template	Follow the Running tests for Express guidance	`yarn lint`	`yarn lint --fix` `yarn prettier --write src/` `yarn lint`	Follow the SonarQube for frontend guidance
Java (Gradle)	Follow the instructions in the Spring Boot template	Follow the Plugins for Spring Boot guidance	`./gradlew --no-daemon check`	Follow the SonarQube for backend guidance	Follow the OWASP Dependency Checks for backend guidance

Advice: If you are troubleshooting a pipeline failure, commands can often be copied from your Jenkins step and run locally.

Running SonarQube Scan Locally

For frontend (Node.js)

Create a user token in SonarQube.
Navigate to your project root in the terminal and run the following command to set the token in your environment variables:
```
export SONAR_TOKEN='user-token-value'
```
Run the SonarQube scan:
```
yarn sonar-scan
```

For backend (Java)

Create a user token in SonarQube.
Navigate to your project root in the terminal and run the following command to set the token in your environment variables:
```
export SONAR_TOKEN='user-token-value'
```
Run the SonarQube scan:
```
./gradlew --no-daemon sonarqube
```

Running Dependency Checks Locally

For backend (Java)

You will need to generate an NVD API key to run the OWASP Dependency Check locally, else they will take a long time to run. You can generate a key by following the instructions on the NVD website.

To run a dependency check locally, execute the following command in the project root in your terminal:

./gradlew \
  --no-daemon \
  -PnvdApiKey=your-api-key \
  dependencyCheckAggregate

This runs the OWASP Dependency Check without connecting to the OWASP database, the Jenkins pipeline scan will connect to to the OWASP database which includes more specific rules.

This page was last reviewed on 18 August 2026. It needs to be reviewed again on 18 February 2027 by the page owner platops-build-notices .