Latest | Homepage

SonarQube 10.7 Documentation

What is SonarQube?

SonarQube is an on-premise analysis tool designed to detect coding issues in 30+ languages, frameworks, and IaC platforms. By integrating directly with your CI pipeline or on one of our supported DevOps platforms, your code is checked against an extensive set of rules that cover many attributes of code, such as maintainability, reliability, and security issues on each merge/pull request.

As a core element of the Sonar solution, SonarQube completes the analysis loop to help you deliver clean code that meets high-quality standards.

Please see the Try out SonarQube page to learn how to get started. For a Software-as-a-Service (SaaS) cloud based tool, see SonarCloud.

The approach to Clean Code

Clean Code is the standard for all code that results in secure, reliable, and maintainable software therefore, writing clean code is essential to maintaining a healthy codebase. This applies to all code: source code, test code, infrastructure as code, glue code, scripts, and more.

Sonar's Clean as You Code approach is a software development practice based on the principle that new code (code that you added or modified recently) needs to comply with quality standards. The Sonar solution implements Clean as You Code by warning you whenever issues are detected in your new code, helping you maintain high standards and focus on code quality by incrementally improving the entire code base.

SonarQube comes with a built-in quality profile designed for each supported language, called the Sonar Way profile. The Sonar way activates a set of rules that should be applicable to most projects and is a starting point to help you implement clean code practices in your organization.

The Sonar Solution

Sonar products are designed to help you achieve a state of Clean Code. By linking SonarLint with SonarCloud or SonarQube, checks are performed at every stage of the development process; we call this the Sonar solution. This means your project settings, new code definitions, and quality profiles are applied locally to an analysis in the IDE. The Sonar solution is designed to help you achieve a state of Clean Code. Your project settings, new code definitions, and the quality profiles managed in SonarCloud are applied locally to an analysis in the IDE.

SonarLint helps catch issues early because it provides immediate feedback in the IDE. As engineers write code, they can find and fix issues even before they commit.
Then, SonarQube and SonarCloud will analyze each pull request before it’s merged, providing another layer of protection against code issues.
Finally, SonarQube and SonarCloud analyze the code on each build as part of your CI/CD workflow and together with the quality profile, prevent code with issues from being released to production.

The Sonar solution helps you incorporate the Clean as You Code methodology by helping engineers pay attention to new code. Focusing on writing new, clean code during development ensures that all code released for production will be incrementally improved over time.

Connected Mode

Connected Mode joins SonarQube with SonarLint to deliver the full Sonar solution. While in Connected Mode, SonarQube sends notifications to SonarLint when a quality gate changes or a new issue is assigned to the user. Smart notifications can be enabled or disabled from the SonarLint UI while creating or editing the connection settings. Additionally, SonarLint helps engineers focus on writing clean code by using the new code definition from the server. Be sure to check out all of the Connected Mode benefits.

Getting started

Now that you've heard about how SonarQube can help you write clean code, you are ready to try out SonarQube for yourself. You can run a local non-production instance of SonarQube and initial project analysis. Installing a local instance gets you up and running quickly, so you can experience SonarQube firsthand. Then, when you're ready to set up SonarQube in production, you'll need to install the server before configuring your first code analysis.

The Analyzing source code section explains how to connect your scanner to your CI pipeline and provides instructions for analyzing your project’s branches and pull requests.

Here is a page with everything you need to Try out SonarQube.

Learn more

Check out the entire suite of Sonar products: SonarQube, SonarCloud, and SonarLint.

Then, have a look at how to fix issues detected by SonarLint for IntelliJ, Visual Studio, VS Code, and Eclipse when combined with SonarQube and SonarCloud, and browse a full list of Sonar Rules and Rule Descriptions available for static code analysis.