Repolode
Submit
SonarSource

SonarSource/sonarqube

Self-hosted code quality and security platform that scans projects for bugs, vulnerabilities and maintainability issues, with Quality Gates for CI pipelines.

Open-source alternative to:CodacyCoverity

View on GitHubWebsite
Stars
11,087
Forks
2,236
Open issues
1
Last commit
2 days ago

What is it?

SonarQube is a static analysis platform that inspects source code to find bugs, security vulnerabilities, security hotspots and structural problems, and explains what to fix and why. Results are shown in a web dashboard and can be surfaced in the IDE, pull requests and CI pipelines.

This repository contains the source of the SonarQube Community Build, the free and open-source edition. It focuses on coverage on new code and uses Quality Gates, pass-or-fail checks, to enforce a standard on each change before it merges. The Community Build supports a subset of the languages covered by the commercial editions.

The project is written in Java and built with Gradle, requiring Java 21. The README describes building a distribution zip that is started with bundled scripts on Linux, macOS and Windows.

Key features

  • 01Detects bugs, reliability issues and security vulnerabilities in source code.
  • 02Flags maintainability and structural issues that make code harder to change.
  • 03Enforces Quality Gates on new code in pull requests and pipelines.
  • 04Explains each finding and its risk, with guidance on the fix.
  • 05Runs as a self-managed server with a web dashboard.

Use cases

  • Adding automated code quality and security checks to a CI pipeline.
  • Tracking code quality trends across a team's repositories on a self-hosted server.
  • Reviewing new code in pull requests before it is merged.

Quick start

  1. 1

    Build the project with Gradle (requires Java 21 and Git)

    ./gradlew build
  2. 2

    Unzip the distribution from sonar-application/build/distributions/ and start the server on Linux

    bin/linux-x86-64/sonar.sh start

Things to know

  • Building from source requires Java 21 and native Git.
  • The Community Build supports fewer languages than the commercial editions.
  • Feature contributions from outside SonarSource are generally not accepted; only minor fixes are typically merged.

Topics

#static-analysis#code-quality#security#linting#ci-cd#java#sonarqube

FAQ

What is sonarqube?
Self-hosted code quality and security platform that scans projects for bugs, vulnerabilities and maintainability issues, with Quality Gates for CI pipelines. SonarQube is a static analysis platform that inspects source code to find bugs, security vulnerabilities, security hotspots and structural problems, and explains what to fix and why. Results are shown in a web dashboard and can be surfaced in the IDE, pull requests and CI pipelines.
Is sonarqube free to use? What license does it have?
sonarqube is open source under the LGPL-3.0 license. Check the license terms before using it in commercial products.
Is sonarqube still maintained?
Actively maintained. The last commit to sonarqube was on Oct 17, 2026.
What can I use sonarqube for?
Adding automated code quality and security checks to a CI pipeline. Tracking code quality trends across a team's repositories on a self-hosted server. Reviewing new code in pull requests before it is merged.
How do I install sonarqube?
Build the project with Gradle (requires Java 21 and Git): ./gradlew build Unzip the distribution from sonar-application/build/distributions/ and start the server on Linux: bin/linux-x86-64/sonar.sh start
Where can I get sonarqube?
The source code and installation instructions are on GitHub: https://github.com/SonarSource/sonarqube

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects