What is the CI verification loop?

Learn how SonarQube analysis and Gitar keep low-quality code out of your main branch.

Once a human or an agent has pushed code to the repository and opened a pull request, the pipeline and all verifications run to detect problems, trigger quality gates, and prevent merging low-quality code into the main branch.

Verification is zero-trust and multi-layered, which means no single check is trusted on its own. Two layers work together on your pull request:

• SonarQube analysis runs on the new code, raises issues as inline comments on the pull request, and computes the quality gate that decides whether the code is fit to merge. See Pull request analysis.
• Gitar adds AI-powered code review to your pull requests: inline comments, summaries, walkthroughs, and diagrams.