SonarQube AI Slop Gate

The decisions self-hosted SonarQube forces when you use it to gate AI-generated code, and how to settle them. Every rule names the wrong default it corrects; there is no rule for what the model already gets right.

Pinned to a date, not a version. SonarQube ships a release every two months, so every claim here was verified against docs.sonarsource.com in July 2026, against SonarQube Server 2026.3 (current LTA 2026.1). 2026.4 had shipped at the time of writing but the documentation still defaulted to 2026.3, so that is what these rules describe — plat-versions-are-calendar-based covers the release train itself. Re-verify anything version-shaped before trusting it, and read docs from the unversioned path (/latest/<page> does not resolve); appending .md to any docs URL returns its markdown source.

The failure this skill exists to prevent is a gate that passes everything. A SonarQube setup assembled from 2024-vintage knowledge will analyze the wrong branch, upload to the wrong server, exit green on a red gate, and skip the duplication and coverage conditions entirely on the small commits that AI-assisted work produces most of. None of those failures announce themselves; the dashboard looks healthy throughout.

When to Apply

Use this skill when:

• Standing up self-hosted SonarQube Server, or reviewing an existing instance, with the goal of catching AI-generated defects continuously rather than reporting on them after the fact
• Designing or tightening a quality gate — especially deciding what to measure on new code versus overall code, and discovering which conditions are silently not evaluated
• Wiring a scan step into CI: scanner properties, tokens, branch and pull-request parameters, coverage report import, or making the pipeline actually block a merge
• Setting up AI Code Assurance — flagging projects, qualifying a gate, or working out why a project reports "AI Code Assurance is off"
• A gate passes changes that obviously contain duplicated or untested generated code, and nobody can explain why

This skill is NOT for: