SonarQube
SonarQube is a platform for continuous inspection of code quality. It performs automatic reviews with static analysis of code to detect bugs, code smells, and vulnerabilities.
Specs Using SonarQube
| Spec | Description | Priority |
|---|---|---|
| ARCH-001 | Layering | critical |
| CS-003 | Method Length Limit | minor |
| CQ-001 | Cyclomatic Complexity Limit | major |
| CQ-002 | No Code Duplication | major |
| CQ-003 | Test Coverage Minimum | major |
| MIG-001 | Upgrade to Java 17 | major |
| MIG-003 | Spring Boot 3 Migration | major |
Quality Gate Conditions
| Condition | Threshold |
|---|---|
new_coverage |
>= 80% |
new_duplicated_lines_density |
< 3% |
new_blocker_issues |
= 0 |
new_critical_issues |
= 0 |
Quick Start
Maven
<plugin>
<groupId>org.sonarsource.scanner.maven</groupId>
<artifactId>sonar-maven-plugin</artifactId>
<version>4.0.0.4121</version>
</plugin>
Config
sonar-project.properties
sonar.projectKey=my-project
sonar.sources=src/main/java
sonar.tests=src/test/java
sonar.java.binaries=target/classes
sonar.java.test.binaries=target/test-classes
Trigger Policy
Runs on PRs only (requires build context). Posts a summary comment on the PR.
Guides
Guides for this tool will be added as the project evolves.