Repolode
Enviar
SonarSource

SonarSource/sonarqube

Self-hosted code quality and security platform that scans projects for bugs, vulnerabilities and maintainability issues, with Quality Gates for CI pipelines.

Alternativa open source a:CodacyCoverity

Ver no GitHubSite
Estrelas
11,087
Forks
2,236
Issues abertas
1
Último commit
anteontem

O que é?

SonarQube is a static analysis platform that inspects source code to find bugs, security vulnerabilities, security hotspots and structural problems, and explains what to fix and why. Results are shown in a web dashboard and can be surfaced in the IDE, pull requests and CI pipelines.

This repository contains the source of the SonarQube Community Build, the free and open-source edition. It focuses on coverage on new code and uses Quality Gates, pass-or-fail checks, to enforce a standard on each change before it merges. The Community Build supports a subset of the languages covered by the commercial editions.

The project is written in Java and built with Gradle, requiring Java 21. The README describes building a distribution zip that is started with bundled scripts on Linux, macOS and Windows.

Recursos principais

  • 01Detects bugs, reliability issues and security vulnerabilities in source code.
  • 02Flags maintainability and structural issues that make code harder to change.
  • 03Enforces Quality Gates on new code in pull requests and pipelines.
  • 04Explains each finding and its risk, with guidance on the fix.
  • 05Runs as a self-managed server with a web dashboard.

Casos de uso

  • Adding automated code quality and security checks to a CI pipeline.
  • Tracking code quality trends across a team's repositories on a self-hosted server.
  • Reviewing new code in pull requests before it is merged.

Tópicos

#static-analysis#code-quality#security#linting#ci-cd#java#sonarqube

Perguntas frequentes

O que é sonarqube?
Self-hosted code quality and security platform that scans projects for bugs, vulnerabilities and maintainability issues, with Quality Gates for CI pipelines. SonarQube is a static analysis platform that inspects source code to find bugs, security vulnerabilities, security hotspots and structural problems, and explains what to fix and why. Results are shown in a web dashboard and can be surfaced in the IDE, pull requests and CI pipelines.
sonarqube é gratuito? Qual é a licença?
sonarqube é open source sob a licença LGPL-3.0. Confira os termos da licença antes de usá-lo em produtos comerciais.
sonarqube ainda é mantido?
Manutenção ativa. O último commit de sonarqube foi em 17 de out. de 2026.
Para que posso usar sonarqube?
Adding automated code quality and security checks to a CI pipeline. Tracking code quality trends across a team's repositories on a self-hosted server. Reviewing new code in pull requests before it is merged.
Onde consigo sonarqube?
O código-fonte e as instruções de instalação estão no GitHub: https://github.com/SonarSource/sonarqube

Resumo gerado por IA a partir do README do projeto. As estatísticas do GitHub são atualizadas diariamente.

Projetos relacionados