GitLab vs. Liquibase vs. SonarQube

GitLab is good if you work a lot with code and do complex repository actions. It gives you a very good overview of what were the states of your branches and the files in them at different stages in time. It's also way easier and more efficient to write pipelines for CI\CD. It's easier to read and it's easier to write them. It takes fewer clicks to achieve the same things with GitLab than it does for competitor products.

Incentivized

Based on my experience so far on using Liquibase in my current project, I have seen that Liquibase changelogs are version control where multiple team members and developers can work together on database and deployed automatically via CI/CD Pipeline integration using github actions and it applies same changelogs to all enviroments to remain in sync and avoid any enviroment drift. Also as Liquibase stores changelog audits in DATABASECHANGELOG table it helps in tracking purposes and to easily rollback any change . Whereas in some scenarios I feel that Liquibase have some drawbacks where if complex transformation between tables is not optimized for bulk data operations which eventually degrades database performance.

Incentivized

SonarQube is excellent if you start using it at the beginning when developing a new system, in this situation you will be able to fix things before they become spread and expensive to correct. It’s a bit less suitable to use on existing code with bad design as it’s usually too expensive to fix everything and only allows you to ensure the situation doesn’t get worse.

Incentivized

• GitLab excels in managing code versions, allowing easy tracking of changes, branch management, and merging contributions.
• It helps maintain code stability and reliability, saving time and effort in the development or research workflow.
• Powerful code review features, enabling collaboration and feedback among team members.
• Robust project management features, including issue tracking, kanban boards, and milestones.

Incentivized

• Liquibase tracks changes in a metadata table contained directly in the target database, making easy administration for the DBA.
• Liquibase handles many validation tests out of the box, making it easy to choose which ones you want to include, with options for writing your own if you choose. This makes it robust and flexible in terms of validation before deployment.
• Liquibase provides easy integration into deployment pipelines for CI/CD. We use it with GitHub for source control and Circle CI for validation and deployment pipelines.

Incentivized

• Detecting bugs and vulnerabilities: SonarQube can identify a wide range of bugs and vulnerabilities in code, such as null pointer exceptions, SQL injection, and cross-site scripting (XSS) attacks. It uses static analysis to analyze the code and identify potential issues, and it can also integrate with dynamic analysis tools to provide even more detailed analysis.
• Measuring code quality: SonarQube can measure a wide range of code quality metrics, such as cyclomatic complexity, duplicated code, and code coverage. This can help teams understand the quality of their code and identify areas that need improvement.
• Providing actionable insights: SonarQube provides detailed information about issues in the code, including the file and line number where the issue occurs and the severity of the issue. This makes it easy for developers to understand and address issues in the code.
• Integrating with other tools: SonarQube can be integrated with a wide range of development tools and programming languages, such as Git, Maven, and Java. This allows teams to use SonarQube in their existing development workflow and take advantage of its powerful code analysis capabilities.
• Managing technical debt: SonarQube provides metrics and insights on the technical debt on the codebase, enabling teams to better prioritize issues to improve the quality of the code.
• Compliance with coding standards: SonarQube can check the code against industry standards like OWASP, CWE and more, making sure the code is compliant with security and coding standards.

Incentivized

• CI variables management is sometimes hard to use, for example, with File type variables. The scope of each variable is also hard to guess.
• Access Token: there are too many types (Personal, Project, global..), and it is hard to identify the scope and where it comes from once created.
• Runners: auto-scaled runners are for the moment hard to put in place, and monitoring is not easy.

Incentivized

• I would like Liquibase to explore all errors in the changelog files compared to one at a time. We spent a lot of time troubleshooting one error at a time versus having a batch log of errors in each file.
• Understanding where to get support on things. I spent a lot of time researching externally to learn what the best practices were. Although I found some of the youtube videos helpful, I would like a little more of a technical support. This may be a feature with the paid tier, however, we leveraged open source.
• Seeing more examples of how others use Liquibase and their usecases will be helpful. That way we can learn from each other which may help us improve on our own deployments.

Incentivized

• Importing a new custom quality profile on SonarQube is a bit tricky, it can be made easier
• Every second time when we want to rerun the server, we have to restart the whole system, otherwise, the server stops and closes automatically
• When we generate a new report a second time and try to access the report, it shows details of the old report only and takes a lot of time to get updated with the details of the new and fresh report generated

Incentivized

I really feel the platform has matured quite faster than others, and it is always at the top of its game compared to the different vendors like GitHub, Azure pipelines, CircleCI, Travis, Jenkins. Since it provides, agents, CI/CD, repository hosting, Secrets management, user management, and Single Sign on; among other features

Incentivized

We are and will continue using Liquibase and it has become an integral part of our portfolio offering, any new product is by default adopting Liquibase stack.

Incentivized

I find it easy to use, I haven't had to do the integration work, so that's why it is a 9/10, cause I can't speak to how easy that part was or the initial set up, but day to day use is great!

Incentivized

Liquibase has several features, on their free plan, that matches exactly our expectations and needs: this already makes it standout from its competitors. On top of that, the setup was straightforward: we are running an integration with Databricks, and there were only two steps truly needed, install the driver and the plugin, done. This is the type of seamless experience our team appreciates the most when evaluating a tool or service.

Incentivized

It can improve in some user experience and usability parts, like the code view and the way we assign issues it's a bit hidden and not highlighted

Incentivized

I've never had experienced outages from GItlab itself, but regarding the code I have deployed to Gitlab, the history helps a lot to trace the cause of the issue or performing a rollback to go back to a working version

Incentivized

GItlab reponsiveness is amazing, has never left me IDLE. I've never had issues even with complex projects. I have not experienced any issues when integrating it with agents for example or SSO

Incentivized

At this point, I do not have much experience with Gitlab support as I have never had to engage them. They have documentation that is helpful, not quite as extensive as other documentation, but helpful nonetheless. They also seem to be relatively responsive on social media platforms (twitter) and really thrived when GitHub was acquired by Microsoft

Incentivized

Liquibase has been responsive and even is letting our group test some new products they are developing and even made code changes to their production system because of a couple bugs we have reported. Liquibase licensing has also been easy and simple. I have nothing bad to say about any of the Liquibase staff I have talked to. They also hold free information webinars for new content that helps spread adoption and moving the product forward.

Incentivized

We we easily able to integrate the SonarQube steps into our TFS process via the Microsoft Marektplace, we didn't have the need to call SonarQube support. We've used their online documentation and community forum if we ran into any issues.

Incentivized

Build process takes a toll.

Incentivized

Gitlab seems more cutting-edge than GitHub; however, its AI tools are not yet as mature as those of CoPilot. It feels like the next-generation product, so as we selected a tool for our startup, we decided to invest in the disruptor in the space. While there are fewer out-of-the-box templates for Gitlab, we have never discovered a lack of feature parity.

Incentivized

There is no real competitor when it comes to what Liquibase does - at least not at the time we considered it three years ago. It was an easy choice in this regard, but we could have said no to it if it made our workload more difficult. But our proof of concept showed there were easy wins to be had by implementing its software.

Incentivized

SonarQube is an open-source. It's a scalable product. The costs for this application, for the kind of job it does, are pretty descent. Pipeline scan is more secured in SonarQube. Its a very good tool and its support multiple languages. Its main core competency is of static code analysis and that is why SonarQube exists and it does it exceedingly well. The quality of scan on code convention, best practices, coding standards, unit test coverage etc makes them one of the best competent tool in the market

Incentivized

I think is very well designed, and like any VCS it works as intended

Incentivized

• GitLab cut down our spent on container, package and infrastructure registry
• Best thing is we can now have everything in single platform which cost effective too
• Quality of support is really good and they do have emergency support team as well which is great

Incentivized

• We need to re-educate developers to use Liquibase.
• In some cases, it is hard to align when several teams work on the same DB.
• On the other hand, Liquibase provides order and consistency in managing DB changes.
• Evidence and traceability are a plus.

Incentivized

• Positive ROI from the standpoint of flagging several issues that would have otherwise likely been unaddressed and caused more time to be spent closer to launch
• Slightly positive ROI from time-saving perspective (it's an automated check which is nice, but depending on the issues it finds, can take developers time to investigate and resolve)