SonarQube

SonarQube analyzes source code without running it. It checks for bugs, security vulnerabilities, hardcoded secrets, code smells, duplication, and test coverage, and reports issues in a dashboard and in pull requests. Teams define quality gates, such as no new critical bugs, which can block a merge when code does not meet the standard, so problems are caught early in development.

It integrates with CI/CD systems like GitHub Actions, GitLab, Jenkins, and Azure DevOps, and with IDEs through SonarLint, which highlights issues as you type. AI features include CodeFix, which suggests changes for issues it finds, and capabilities designed to check AI-generated code, an area of growing concern as more code is written by assistants. It supports a large number of languages and frameworks.

SonarQube comes as a free community edition for self-hosting, paid editions with more languages and features, and SonarQube Cloud as a hosted service. Static analysis can produce false positives, so teams need to tune rules. Competitors include Snyk, Checkmarx, Semgrep, Veracode, and CodeQL on GitHub, with Codacy and DeepSource as other quality tools. SonarQube is a standard choice for continuous code quality.