Overview
What is SonarQube?
SonarQube is a code quality and vulnerability solution for development teams that integrates with CI/CD pipelines to ensure the software you produce is secure, reliable, and maintainable.
SonarQube: The mandatory tool to elevate your code quality quality
Code Quality is a Must!
Sonarqube - The ultimate tool for end to end code analysis
SonarQube, you don't need to search more!
SonarQube- A perfect QC for Reviewers
SonarQube: Helper of Dev and organisation for better code quality and security practices.
Easy to use DecSecOps application
SonarQube - solid static code analysis tool
Easy to use DevSecOps tool
Let the SonarQube guide your devs towards a better future.
Cost effective way to find and correct issues early
Don't Skip Static Analysis with Sonar!
SonarQube your free & friendly DevSecOps tool
SonarQube Must in Code Pipeline
SonarQube: A great solution for code quality management and analysis
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Pricing
Community
Free
Developer EDITION
Starts at $160
Enterprise EDITION
Starts at $21,000
Entry-level set up fee?
- No setup fee
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Starting price (does not include set up fee)
- $160 per year per installation
Product Demos
Understanding Issues with Multiple Locations
SonarQube analysis with Jenkins
GitHub: Block the Merge of a Pull Requests
Product Details
- About
- Integrations
- Competitors
- Tech Details
- FAQs
What is SonarQube?
SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating with DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of the release pipeline, displaying pass/fail results for new code based on quality profiles that can be customized to a company's standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production. At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides the user through issue resolution, fostering a culture of continuous improvement. SonarQube’s reporting helps dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. UltimatelySonarQube aims to enable users to achieve a state of Clean Code, leading to secure, reliable, and maintainable software.
SonarQube Screenshots
SonarQube Integrations
SonarQube Competitors
SonarQube Technical Details
Deployment Types | On-premise, Software as a Service (SaaS), Cloud, or Web-Based |
---|---|
Operating Systems | Windows, Linux, Mac, Cloud |
Mobile Application | No |
Supported Countries | Global |
Supported Languages | Community localization plugins support several languages. |
Frequently Asked Questions
Comparisons
Compare with
Reviews and Ratings
(88)Community Insights
- Business Problems Solved
- Pros
- Cons
- Recommendations
SonarQube has proven to be invaluable for software engineering companies looking to ensure code quality and prevent the release of faulty software. Users have utilized SonarQube for a wide range of use cases, including generating code quality reports, detecting bugs, vulnerabilities, and code smells, and analyzing code coverage for JUnit tests. The software serves as a static application security tool, helping to identify and fix security issues and vulnerabilities in code. It is seamlessly integrated into Azure DevOps Continuous Integration pipelines, providing detailed issue descriptions and code highlights to identify vulnerabilities. With its comprehensive analysis of the codebase, SonarQube helps in enforcing good practices and preventing bugs, serving as a quality gate for software development. By utilizing static code analysis, SonarQube helps developers create bug-free code and detect vulnerabilities early on, saving valuable time in the development process. Additionally, SonarQube aids in maintaining code quality, improving coding structure, and ensuring code reliability and security. Beyond these primary use cases, users have found value in using SonarQube to check code coverage, follow coding suggestions, manage technical debt, monitor unit test coverage for C++ projects, track bugs and code quality while the security team focuses on vulnerability scanning, and adhere to industry standards. Its customization options allow users to tailor the rules to their specific needs and enable toll-gating to prevent bad code from reaching production. The plugin-based framework of SonarQube ensures extensibility for new use cases and has been highly regarded by users who find it easy to integrate with existing tools and infrastructure. Whether it's identifying design flaws before committing or merging code or tracking legacy code issues and offering solutions for improvement, SonarQube plays a crucial role in improving the overall quality of software development projects across various industries.
Efficient and Precise Code Quality Reports: Multiple users have praised SonarQube for its highly efficient and precise code quality reports. This feature has allowed them to gain a comprehensive understanding of their code's quality, identify areas for improvement, and enhance the overall quality of their code.
Detection of Bugs and Vulnerabilities: Reviewers have found SonarQube's ability to highlight bugs and vulnerabilities in the codebase to be a valuable asset. This feature has helped them identify potential issues early on, enabling them to take proactive measures to improve the code's quality and security.
Valuable Code Remediation Suggestions: Many users have expressed appreciation for SonarQube's suggestions for code remediation and resolution. These suggestions have proven extremely valuable in helping them make their code cleaner, more maintainable, and ultimately improving long-term code quality.
Tricky Importing of Custom Quality Profile: Reviewers have found that importing a new custom quality profile on SonarQube can be challenging and tricky, causing frustration during the setup process.
Inconvenient Server Restart Requirement: Some users have reported the inconvenience of having to restart the server every second time in order to rerun it, which disrupts their workflow and wastes time.
Slow Report Generation and Updating: Several reviewers have mentioned that generating a new report on SonarQube takes a significant amount of time. Additionally, they have experienced delays in updating the details of the new report, as it continues to display information from previous reports instead.
Based on user feedback, here are the most common recommendations for using SonarQube:
Consider using SonarQube if your team size is above 10. For smaller groups, it is recommended to use the community version or integrate Sonarlint with IDE for free.
Integrate SonarQube with CI servers like Cloudbees and Jenkins, as well as version control and testing tools like UFT. This will make the development process smoother and more efficient.
Leverage SonarQube's features, such as code coverage analysis, testing, and code health monitoring. Users find these features valuable for understanding code conventions, maintaining code quality, and identifying security issues or code smells in applications.
Attribute Ratings
Reviews
(1-17 of 17)Code Quality is a Must!
- Ongoing code quality management
- Increase developer skills.
- Detect and report problems.
- Scale with business needs
- Optimize the quality
- it is sustainable
- The main “disadvantage” is code maintenance, being more expensive, it also takes more time, as well as producing “false positives”.
In addition, it performs a calculation of the technical debt. It can be used in any scenario.
In order to use SonarQube, you need to install a server component, where the engine that performs the analysis and stores the results is located, and the analysis must be invoked in some way, which can be done with a client called SonarQube Scanner.
You can also integrate the analysis into the IDE you are using, with a plugin called SonarLint!.
Sonarqube - The ultimate tool for end to end code analysis
- Easy integration with all coding languages
- Plugin integration ensures easy extensibility
- Detects code smells and vulnerabilities
- Generate test coverage reports
- Custom quality gates to ensure no bad code is merged
- Learning curve is steep
- Report generation is often very time consuming
- Works particularly well for Java, but not so good for Python and R
- Initial setup is quite complicated
SonarQube - solid static code analysis tool
- Works well with .Net
- Has a nice extension that allows us to run it in our IDE (visual studio)
- Is customizable in the sense that you can write your own rule set that you want SonarQube to analyze the code against
- Often it finds errors that aren't really errors that have impact, takes a lot of time to sort through those cases
- It's a good screener, but by no means can it catch all bugs or be the sole predictor of code quality, so the metrics that it provides need to be caveated when reporting to leadership, etc
Let the SonarQube guide your devs towards a better future.
- Gives advice on coding practices
- Rates our code over time
- Highlights worst offending code to make prioritization easier
- Helps improve our code over time
- Notifications based on findings needs a lot of work. Options are extremely basic so far.
- Integration of Dependency Check is very basic and could use some UX love.
- Making it easier to turn down the noise of problems so teams can focus on the highest priority first without getting bogged down.
Don't Skip Static Analysis with Sonar!
- Scanning source code for a defined set of quality gates and rules
- Reporting security issues with static scans
- Managing portfolios application in the enterprise edition
- The scanner is a bit heavy and can be rewritten in a lighter language (like Go or rust)
- Scans can take a bit of time
- Some languages like C++ are much harder to scan than others
Great Code Analysis Tool
- Static code analysis
- Code best practices
- Quality profile selection
It is also useful to create custom Quality Profiles to educate new developers that join the company.
SonarQube to make your project secure
- Code coverage
- Shows potential fixes
- Speed
- Sometimes the messages can be long and for someone's first time seeing this it can be hard to find what to look for
- Sometimes potential fixes are not available
- Documentation on setting up with Jenkins was hard to follow at some parts
Quick and easy static analysis and bug detection
- Standardized scanning tools to make sure code doesn't use obvious code smells
- Enfrocement of standardized naming conventions in code
- Identification of potentially needlessly complicated code
- Identify code smells
- Low level bugs
- Basic static analysis
- Reports can take a bit of time
- Custom rules can be a bit annoying to setup
SonarQube review by a Hybris Developer
One business problem I mostly faced was that if we had run the server once, and tried to run it again if we closed it, then it does not run and closes automatically. To run the server again we have to restart the system, then only it works, so those issues can be resolved.
The scope of my case is to generate the code quality report for the codebase in our project according to the custom quality profile we add in SonarQube.
- Generating code quality report
- Calculates junit coverage of the codebase very efficiently and precisely
- Highlights the bugs and vulnerabilities in our codebase
- Informs the user of the improvements which can be done to the code to make it cleaner
- SonarQube also suggests remediation and resolution of the problems it highlights
- Importing a new custom quality profile on SonarQube is a bit tricky, it can be made easier
- Every second time when we want to rerun the server, we have to restart the whole system, otherwise, the server stops and closes automatically
- When we generate a new report a second time and try to access the report, it shows details of the old report only and takes a lot of time to get updated with the details of the new and fresh report generated
SonarQube, the best choice for a Static Code Analysis tool leveraging application security at large
It being used in our Azure devops Continuous Integration pipeline to identify the vulnerabilities in code and provides detailed issue descriptions and code highlights that explain why your code is at risk.
- Identify Security Vulnerabilities and highlights the code
- Highlight suspicious code snippets that developers should review
- Providing security feedback during code review
- Identify technical debts in code
- The community version have some issues, example Integrating with Azure or Single Sign On
- Automation scripts can be improved. At times you have to configure some of the rules in the detection
- It takes time to configure and create profiles
Using SonarQube professionally for more than 7 years and fully recommend it to any Software Engineer
- Static Code Analysis
- Security Vulnerabilities Scan
- Multi software language support
- Configurable quality gates for PR analysis
- Better IDE integration and support
- Easier GitHub actions integration and support
- Better support and integration for dynamic code analysis during automated tests
SonarQube: The go-to tool for code quality
- Ability to provide static code coverage in integration with Jenkins CI/CD pipeline.
- Ability to define custom rule sets, based on our organizational requirements.
- Ability to add custom toll-gating for different applications.
- Enterprise license is very costly.
- Runs only on Java 11.
- Another major issue is the way elastic search is used in Sonarqube, it makes it slightly challenging to run on a cloud environment like AWS.
- Code scanning & determining static code issues and bad practices.
- Customizing these rules and blockers at the application/module level.
- Easy integration with Jenkins CI/CD pipeline.
- Enterprise version provides the ability to integrate the scanning results with the code review process.
- If you are a small organization & can't afford the enterprise license costs. You can go ahead with a free community version in this case albeit with limited features.
- Needs Java 11 & PostgresSQL database, which are not very common in most companies.
SAST Tools selection - SonarQube to the rescue
- Easy to integrate with MS tech stack
- Scans can be configured
- Endpoints can are setup on central server
- Reporting on SonarQube is poor
- The configuration is not intuitive
- Role and IAM access is not accurate, too much dependence on admin
Quality archway for projects
- Best thing about it is that it offers an online instance (SonarCloud) where we can dry run an open source project by forking a github repository
- Provides detailed analysis of the stacks that it checks for bugs and issues in code stacks.
- Provides a good amount of documentation on how for configuration and installation and how to use it.
- Provides a strong integration with azure devops and jenkins for creating DSL pipelines.
- Local dashboard wont work without java installed on your machine
- If talking about the local ui the configuration may be quite complex. Needs an experts advise
- Its enterprise edition cost a fortune depending on a company size or users that may use it.
Great tool to keep your code clean
- Finding security flaws.
- Finding code that does not follow best practices and standards.
- Looking for code coverage.
- For code "smells" it would be nice to have different levels of issues.
- It could be easier to define policies for different levels of code "smells."
- Prioritize different types of code "smells."
Excellent tool for enforcing good coding practices and conventions
The business problem we had in the past was that we weren't folloiwng a standard deveopment process. SonarQube offered us the ability to see code smells and apply our own development standards. Our code has become more robust and resilient because SonarQube helps catch problems before they're checked in.
- SonarQube allows us to apply our own coding stardards during the check-in process so that our code is more standardized.
- SonarQube forces our team members to write enough unit tests to have code coverage which in turn helps us not to break existing code during check-ins.
- One area where SonarQube is lacking is letting us know how much code coverage we have before we start our check-in process. A live code coverage percentage built into Visual Studio would be very handy.
It is also very handy to have SonarQube built right into our continuous integration process. Doing it this way results in having less worry around whether our coding standards have been followed. They are automatically applied before code is checked in.
Sonarqube is a worth static analysis tool
- Core competency of static analysis. This is why SonarQube exists and it does it exceedingly well.
- Customized quality settings let you tailor the tool for your specific needs.
- Support for many languages including C, C++, Python, and more.
- Ability to set automated alerts. For instance, when code hasn't been scanned in a long period of time.
- Tighter integration with issue tracking systems such as jira and Gitlab.