Choosing Between Leak Period and Overall Quality Gates in SonarQube
Learn how to decide between SonarQube’s Leak Period and Overall Quality Gates, see a side‑by‑side comparison, and follow a concrete setup and validation example.
Loading…
ReadMeFeed / Community knowledge
Sonarqube
Real questions. Useful conversations. Find the people who know your stack.
Sonarqube
Security & identity · #sonarqube
Using SonarQube’s Leak Period to Focus on New Code Issues
Learn how to configure SonarQube’s Leak Period (New Code) so your quality gate only counts issues introduced after a chosen baseline, reducing noise from historic debt.
Quality Gates as a Merge Gate: Using SonarQube New Code to Protect Forward Progress
Use SonarQube Quality Gates scoped to New Code to turn code quality metrics into an enforced merge decision without blocking delivery on legacy debt.
Branch Analysis in SonarQube: When to Enable All Branches vs. Selected Branches
Decide whether to run SonarQube Branch Analysis on every branch or just selected ones. This guide outlines constraints, compares options, explains trade‑offs, and shows a practical SonarScanner configuration example.
SonarQube analysis retries: overwrite the same branch key or use a distinct key per attempt?
A CI pipeline needs to retry a SonarQube analysis step when a run fails transiently, and the goal is that a resubmitted report produces exactly one current analysis per build — no duplicated issue counts and no polluted measure history. Two documented approaches exist. Re-running the scanner with the identical sonar.projectKey and sonar.branch.name replaces
Quality Gate worker pool concurrency limits
In high-throughput CI environments, the SonarQube Quality Gate evaluation process can introduce significant latency. When multiple projects trigger analysis simultaneously, the default worker pool size may limit the number of concurrent evaluations, causing subsequent analysis tasks to queue. This behavior creates a trade-off between maintaining system stabi
SonarQube Community Edition self-hosted versus SonarCloud for low-traffic private repositories
Objective Reduce monthly cost for a low-traffic SonarQube deployment that analyzes private repositories by selecting either self-hosted Community Edition or SonarCloud. Constraints and uncertainty Community Edition has no license fee but requires a virtual machine, PostgreSQL, and search infrastructure. JVM heap and search resource requirements apply even at
SonarQube server-side UTC scheduling versus client-side browser time zone display consistency
Integration boundary SonarQube persists all timestamps as UTC in the database and returns ISO 8601 UTC strings from its REST API, while the web UI performs client-side conversion to the browser's local time zone. Scheduled tasks such as project analysis and housekeeping execute according to the JVM default time zone, and server-side report exports (PDF, CSV)
SonarQube Scanner: Missing Timeout Configuration
SonarQube Scanner: Missing Timeout Configuration The primary goal is to enforce a maximum duration for a SonarQube analysis so that CI pipelines can fail fast and resources are not tied up indefinitely. Current Constraints The Scanner does not expose a built‑in timeout setting; analyses run until completion or server shutdown. Only the Enterprise Edition off