Issues reported in GitHub

SonarQube Cloud reports issues on your GitHub pull requests. It can also display security issues as code scanning alerts in the GitHub interface.

Pull request decoration

SonarQube Cloud provides issue reporting for GitHub pull requests. Besides the pull request analysis summary found in the Checks and Conversation tabs, you will also see issues reported as inline annotations directly within the Files changed tab as illustrated below.

From an inline annotation, you can:

• View the corresponding issue in SonarQube Cloud: copy-paste in your browser the See more on link below the annotation text.
• View the pull request analysis summary in SonarQube Cloud: select the View details button. If this button is not available, select the Try the new experience link in the top right corner of your pull request page as illustrated below.

• As a project admin, you can disable the pull request inline annotations for your project. See Disabling the inline annotations.
• Pull request decoration is only supported with a bound project and requires that pull request integration be correctly configured for your project. See Setting up pull request integration.
• If pull requests on a specific repository aren't decorated, check that the SonarQubeCloud GitHub app has access to that repository. See Diagnosing missing pull request decoration or analysis.

Using the Remediation agent on your pull requests

The SonarQube Remediation Agent runs an independent review and analysis to help you fix reliability and maintainability issues found in your latest code. It focuses on issues in your backlog, discovered in your main branch analysis, and, for GitHub-bound projects, on issues found in your latest pull request (PR).

The agent uses Anthropic's Claude Opus 4.6 to generate fix suggestions in the background and checks that the new code does not introduce new issues before offering the suggestion.

To enable and install the agent, check out the Remediation Agent page. To understand the agent's behavior and learn how to engage with the agent in your pull request, have a look at the Pull request fix suggestions and Backlog fix suggestions pages.

Code scanning alerts

Code scanning alerts are not yet supported with GHE.com Cloud organizations.

With the Enterprise plan, when you analyze a project in SonarQube Cloud, the detected security issues are displayed on the GitHub interface as code scanning alerts. When you change the status of a security issue in the SonarQube interface that status change is immediately reflected in the GitHub interface. Similarly, if you change the status of a code scanning alert in GitHub, that change is reflected in SonarQube.

To report code scanning alerts, the project must be bound and correctly set up. See Configuring GitHub project binding for more details.

To view and manage your code scanning alerts:

1. In GitHub, go to your repository’s Security > Code scanning alerts tab.

2. Select View alerts to see the full list.

3. When you change the status of a security vulnerability in the SonarQube Cloud interface that status change will be immediately reflected in the GitHub interface and vice versa.

Related pages

• Configuring GitHub project binding

For AI-powered review comments directly in pull requests, see Gitar, a separate Sonar product.