180744-0 SSD Brand Name - SonarQube .docx

SOLE-SOURCE DETERMINATION MEMORANDUM

and BRAND NAME SPECIFICATION Sole Source Notice #

Goods or Services: SonarQube Enterprise Edition, with up to 10 million lines of credit Estimated Total Price: $330,000 Sole Source Authority: Agency is authorized under ORS 413.333 and by DAS Delegation REQ-10000-00020921 to award a contract as a sole-source procurement that complies with ORS 279.075 and OAR 137-047-0275.

1. PURCHASE INFORMATION & BACKGROUND.

1.1 Summary. This sole source determination applies to the purchase of SonarQube software, an on-premises software platform used to measure and analyze source code. Agency is purchasing an annual subscription renewal for the software through Oregon’s Software Value-Added Reseller (SVAR) price agreement with SHI, Inc. (Vendor). SonarQube is the only product on the market that meets Agency requirements, as described in the attached Determination of Brand Name Specification (see Attachment 1).

1.2 Background. Agency initially purchased a one-year software subscription to SonarQube from the Vendor through statewide SVAR price agreement #6454. This initial term started 12/1/2020 and included a maximum of up to 1 million lines of code (LOC). Approximately half-way through that subscription year, Agency purchased another renewal from Vendor with an increased maximum LOC of 10 million and a pro-rated credit for the remainder of the initial subscription. That renewal extended the subscription until 6/30/2022. OHA then renewed the software subscription again through 6/30/2023. A new subscription is now critical to avoid serious disruption to Agency’s software environments.

1.3 Current Purchase and Procurement Method.

Agency seeks to renew the subscription for the 2023-2024 term, and reserves the right to purchase additional renewals and related goods or services to include to include on-call maintenance, preventative maintenance, repair (unless available on DAS price agreement), or training, up to Estimated Total Price listed above.

Agency will post notice of this Sole Source Determination and Brand Name Specification on OregonBuys for seven days. If no protests are received, it will award a contract to Vendor at the end of that time. This method of procurement is one of the options for selecting a product for purchase from SVAR price agreement #PO-10700-00014971, which replaced SVAR 6454.

1.4 Vendor Information.

2. PROTESTS, QUESTIONS, and SOLE POINT OF CONTACT.

Protests are due within seven calendar days after the first date the notice is posted on OregonBuys, by the closing time stated in the notice summary. Protests must be in writing-- protests via telephone will not be accepted. For this purpose, “writing” includes email as well as paper documentation received by mail or hand-delivery by the indicated time and date at the following address.

Mail or Hand-delivery:

Oregon Department of Human Services Office of Contracts & Procurement ATTN: Traci Friedl 500 Summer St, Suite E03 Salem, OR 97301 Email: traci.j.friedl@odhsoha.oregon.gov Phone: 971-374-3472 (for inquiries only—no protests will be accepted by telephone)

3. FINDINGS OF FACT.

See Attachment 1, Determination of Brand Name Specification, attached hereto and incorporated herein by this reference.

APPROVED BY:

Signed by DPO electronically via OregonBuys

Kirk N. Rhoades or acting DPO

Attachment 1

DETERMINATION OF BRAND NAME SPECIFICATION

Authority: OHA has the authority under ORS 413.033 to use a Brand Name Specification in compliance with ORS 279B.215.

1. Brand Name: SonarQube

1.1 Product Cost.

1.2 Product Description: SonarQube is an on-premises software platform used for measuring and analyzing source code quality to make the code more reliable, readable, and secure. This self-managed, automatic code review tool systematically helps users deliver clean code. SonarQube integrates into the user’s existing workflow to detect and contain code issues, allowing ongoing and consistent code inspections of user projects. The tool analyses 30+ different programming languages and integrates into the user’s continuous integration/continuous development (CI/CD) pipeline and DevOps platform to ensure code meets high-quality standards. SonarQube is the only non-proprietary, static, code analysis tool on the market that can cover the wide range of coding languages, including legacy code, utilized by OIS-supported agencies.

1.3 Brand Name:

2. BACKGROUND.

OHA initially purchased a one-year software subscription to SonarQube from the Vendor through statewide Software Value-Added Reseller (SVAR) price agreement #6454. This initial term started 12/1/2020 and included a maximum of up to 1 million lines of code (LOC). Approximately half-way through that subscription year, OHA purchased another renewal from Vendor with an increased maximum LOC of 10 million and credit for the remainder of the initial subscription. The renewal extended the subscription until 6/30/2022. OHA renewed the software subscription again for a new expiration date of 6/30/2023.

OHA now needs to renew its SonarQube subscription through 6/30/2024, with the option for additional renewals as described in section 1.3 of the Sole Source Determination to which this Attachment 1 is attached.

3. FINDINGS.

Based on the findings below, OHA has determined that use of a brand name specification for this product is advantageous due to the quality, performance, functionality, and other characteristics of the product.

OHA needs a tool to ensure the agencies supported by OIS are getting high quality, secure code. SonarQube is the only code analysis tool on the market that that covers the range of software languages, including legacy code, utilized by OIS.

Findings to satisfy required standards:

|X| Use of a brand name specification is unlikely to encourage favoritism in the awarding of public contracts or substantially diminish competition for public contracts:

OHA is purchasing SonarQube through a statewide SVAR price agreement, which was awarded to the vendor pursuant to a competitive process. Agencies may use a brand name justification to determine the best product to purchase from the SVAR. Competition will not be diminished because no other product is equivalent to the quality, performance, and function of SonarSource.

or |_| Use of a brand name specification would result in substantial cost savings to the agency or the public:

or |X| There is only one manufacturer or seller of the product of the quality, performance or functionality required:

(i) Functionality and Performance. SonarQube is the sole non-proprietary, static code analysis tool on the market that can cover the range of software languages utilized within OIS. The current software environment for OIS-supported agencies contains extensive legacy (not current industry standard) code such as COBOL, older versions of Java, JavaScript, PHP, VB6, and more that are not supported by other static code inspection tools. There are two other tools that work with one or two types of aging code, like COBOL, but not all types needed. Moreover, those tools further limit the ability to maintain aging code bases by using their own, proprietary code.

(ii) Quality. SonarQube is an industry leader in seamlessly performing code-checking functions within a CI/CD pipeline when using Azure DevOps Services or Azure DevOps Services. This method is in wide use across OIS and has significantly increased code quality while also accelerating deployment cycles. The two other providers referenced in section (i) have not released updates since 2020.

or |X| The efficient utilization of existing goods requires the acquisition of compatible goods or services:

Prior use has proven SonarQube to be a very effective and time-saving tool for OIS development teams, and its ability to seamlessly integrate with OIS DevOps pipelines has accelerated OIS’s ability to deliver business value to program areas in the agencies it supports, including programs that serve those most in need such as Child Welfare, Vocational Rehabilitation, and Public Health. Failure to continue the existing service would decrease code quality and put data security at risk, with no suitable product to replace it.