SonarQube

SonarQube is the leading tool for continuous inspection of code quality. It detects bugs, vulnerabilities (SAST), and code smells in over 30 programming languages.

When to Use

• Code Quality Gates: "Block the merge if Code Coverage < 80%".
• Technical Debt Management: Tracking "Code Smells" and duplication over time.
• Vulnerability Detection: Finding SQL Injection, XSS, and hardcoded secrets in source code.

Quick Start (Docker)

docker run -d --name sonarqube -p 9000:9000 sonarqube:lts
# Login: admin/admin at http://localhost:9000