ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Learn how to set up, tweak, and enforce SonarQube Quality Gates in your CI pipeline. See a step‑by‑step example, trade‑offs, and how to verify gate status via UI and API.
Learn how to decide between SonarQube’s Leak Period and Overall Quality Gates, see a side‑by‑side comparison, and follow a concrete setup and validation example.
Learn how to configure SonarQube’s Leak Period (New Code) so your quality gate only counts issues introduced after a chosen baseline, reducing noise from historic debt.
Assuming a recent JetBrains JVM linter image, the goal is to use its resource-leak inspections for unclosed Closeable values as a CI guard, so a leak-prone pattern cannot quietly return after a fix. Static analysis inspects source, not runtime behavior, so it complements rather than replaces profiler or heap-dump evidence. Two constraints shape the setup: St
In high-throughput CI environments, the SonarQube Quality Gate evaluation process can introduce significant latency. When multiple projects trigger analysis simultaneously, the default worker pool size may limit the number of concurrent evaluations, causing subsequent analysis tasks to queue. This behavior creates a trade-off between maintaining system stabi
Qodana baseline allows teams to snapshot existing issues so subsequent runs report only newly introduced problems against a quality gate. The baseline file is compared to current analysis results, and behavior depends on the linter image version, inspection profile, and how analysis caching is managed in CI. It is unclear under which configuration or code ch
Goal Determine how SonarQube handles self‑signed or expired SSL certificates when downloading plugins and how that affects future plugin updates, while still evaluating Quality Gates. Constraints SonarQube relies on the JVM’s SSLContext for certificate validation. No documented configuration exists to bypass SSL checks for plugin URLs; users must import cert
Context SonarQube notifies subscribers only when a Quality Gate status changes (e.g., OK to ERROR) and sends "New issues assigned to me" once per issue assignment. Users can subscribe or unsubscribe per project to specific notification types, but the platform does not provide built-in digest delivery, quiet-hours scheduling, or severity-threshold filtering.
We run Qodana in CI with a pinned linter image tag and a versioned qodana.yaml to keep analysis repeatable across developer machines and pipelines. To adopt it on a legacy module, we generated a baseline file (qodana.sarif.json) so the quality gate only fails on new violations rather than the existing backlog. What we cannot pin down is the baseline's matchi
sonarqube
qodana