Last Updated: November 21, 2025
SonarQube
Code quality and security analysis
Analysis Types
| Item | Description |
|---|---|
Bugs
|
Reliability issues |
Vulnerabilities
|
Security issues |
Code Smells
|
Maintainability issues |
Coverage
|
Test coverage |
Duplications
|
Code duplication |
Security Hotspots
|
Security review points |
Running Analysis
sonar-scanner
Scan current directory
mvn sonar:sonar
Maven project
gradle sonarqube
Gradle project
npm run sonar
Node.js project (with config)
Quality Gates
| Item | Description |
|---|---|
Coverage
|
Minimum test coverage |
Duplications
|
Max code duplication |
Maintainability
|
Max technical debt |
Reliability
|
No critical bugs |
Security
|
No vulnerabilities |
Best Practices
- Integrate into CI/CD pipeline
- Set quality gates for PRs
- Review security hotspots regularly
- Track technical debt over time
💡 Pro Tips
Quick Reference
SonarQube prevents code quality degradation