sonarqube
Installation
SKILL.md
SonarQube
SonarQube is the leading tool for continuous inspection of code quality. It detects bugs, vulnerabilities (SAST), and code smells in over 30 programming languages.
When to Use
- Continuous Code Quality & Clean Code Auditing: Analyzing codebases for bugs, vulnerabilities, security hotspots, and code smells.
- Quality Gates in Pull Requests: Enforcing that new code meets strict quality standards (test coverage, zero new bugs) before merging.
- Technical Debt & Maintainability Tracking: Measuring duplication percentage, complexity scores, and estimated remediation time.
- Enterprise Security Compliance: Ensuring codebases comply with security standards (OWASP Top 10, CWE, SANS Top 25).
Quick Start
docker run -d --name sonarqube -p 9000:9000 sonarqube:lts
# Login: admin/admin at http://localhost:9000