SonarQube
SonarQube is the most widely used platform for static code analysis — it scans your codebase for bugs, vulnerabilities, code smells, and coverage gaps without executing the code. Getting it running takes about 30 minutes: start the server (Docker is easiest), configure a project, run the scanner, and read the results
SonarQube
Security hotspots are code locations that require a human security review — they might be fine, or they might be vulnerabilities. Unlike vulnerabilities (which are confirmed issues), hotspots are flagged for review. SonarQube tracks their review status: TO_REVIEW, ACKNOWLEDGED, SAFE, or FIXED. Key Takeaways Hotspots ≠ Vulnerabilities. A vulnerability is a
SonarQube
A Quality Gate is a pass/fail threshold in SonarQube — it answers the question "is this code good enough to merge?" You configure conditions (e.g., "no new critical bugs", "coverage on new code ≥ 80%") and the gate either passes or fails the analysis.
SonarQube
SonarQube PR decoration posts inline comments directly on changed lines in pull requests and adds a quality gate status check. Reviewers see new bugs and vulnerabilities without leaving the PR review interface. Key Takeaways PR decoration is separate from the main branch analysis. SonarQube analyzes only changed code in a
SonarQube
For a monorepo, you have two choices: one SonarQube project for the whole repo, or separate projects per service. Separate projects give you independent quality gates and metrics per service. One project is simpler but mixes metrics for unrelated services. Key Takeaways One project per service is usually the right
SonarQube
SonarQube ships with thousands of rules, but your team likely has conventions the built-in rules don't cover. Custom rules let you enforce team-specific patterns — banned methods, required annotations, naming conventions — using the SonarQube plugin API or simpler XPath/template rules. Key Takeaways Three ways to add
SonarQube
SonarQube doesn't run your tests — it reads coverage reports that your test runner produces. To see coverage in SonarQube, you need two things: a test run that generates a coverage file (LCOV, JaCoCo XML, Cobertura XML, etc.) and a scanner configuration that tells SonarQube where to find it.
SonarQube
SonarQube branch analysis creates a separate quality view for each branch. You can see the quality gate status of feature branches independently from main, compare coverage and issues per branch, and set branch-specific quality gates. Key Takeaways Branch analysis requires Developer Edition or higher. Community Edition only supports the
Testing
SonarQube quality gates block merges when code doesn't meet your team's standards — coverage thresholds, duplication limits, security ratings. This guide covers the full integration: running tests with coverage, sending results to SonarQube, and failing CI when the quality gate fails. What Are SonarQube Quality Gates? A