sonarqube-scan

Static analysis scans source code without executing it to detect security vulnerabilities, bugs, and code quality issues. SonarQube/SonarCloud performs this analysis on Python projects, categorizing findings by severity and type, then uploads results to a centralized dashboard for tracking and remediation.

Yes. SonarQube scans integrate directly into CI/CD workflows to gate code changes based on quality metrics. The Skill runs scans automatically, generates quality reports, and uploads results to SonarCloud, enabling teams to enforce quality standards before merging.

To run SonarQube scans, you need Python, pip, the pysonar client installed, and SonarCloud credentials including an authentication token, project key, and organization name. The Skill executes scans across specified source files with optional exclusions and branch configuration.

SonarQube analyzes code patterns to detect code smells—maintainability issues like duplicated code, complex methods, and poor naming—and quantifies technical debt as the effort required to remediate these issues. Reports prioritize findings by impact and severity.

Yes. The Skill supports optional exclusion patterns to skip specific files or directories during scans. You configure exclusions and other scan parameters like branch settings before execution to focus analysis on relevant source code.

Local scans provide immediate feedback during development; pipeline scans enforce quality gates on every commit. Both use the same SonarQube analysis engine but pipeline scans ensure consistent, automated quality checks before code merges and produce historical trend reports.