Skip to content

Code Quality Overview

What You'll Learn

  • Where SonarQube fits among linters, security scanners, and paid platforms
  • The recommended path from installation to an enforced quality gate
  • How the pages in this section build on each other

SonarQube helps teams check code quality and security issues as part of normal development and CI/CD work. It is useful when you want automated feedback on bugs, vulnerabilities, code smells, duplication, and quality gates.

SonarQube is one option in a much larger market — this section also maps the surrounding ecosystem of open-source linters, security scanners, and paid SaaS platforms so you can combine them deliberately.

What This Section Covers

  • Installing SonarQube on Ubuntu
  • Connecting SonarQube to PostgreSQL
  • Integrating scans into Jenkins pipelines
  • Open-source tools and libraries — ruff, ESLint, Checkstyle, SpotBugs, Semgrep, Gitleaks, Trivy, JaCoCo, and how to wire them into CI
  • Paid and SaaS platforms — SonarCloud, GitHub Advanced Security (CodeQL), Snyk, Codacy, Qlty, DeepSource, Codecov, Veracode, Checkmarx

Why Teams Use SonarQube

  • Finds quality and security issues early
  • Supports many programming languages
  • Adds quality gates to pull request and pipeline workflows
  • Makes technical debt easier to track over time
  1. Install SonarQube
  2. Configure the database and service
  3. Connect Jenkins
  4. Add analysis to a pipeline
  5. Enforce a quality gate

Tip

For production use, plan for enough memory, persistent storage, backups, and proper access control from the start.

Common Mistakes

  • Gating on overall code metrics instead of new code, so legacy debt blocks every change.
  • Treating SonarQube as the only check instead of running fast linters locally and in CI first.
  • Ignoring security hotspots because they aren't marked as bugs.
  • Leaving the default admin password, and not backing up the database.

Interview Questions

  • What is a quality gate, and what should it check?
  • What does "clean as you code" mean?
  • What's the difference between SAST, SCA, and secrets scanning?

Next

Continue to Open-Source Code Quality Tools.