SonarQube — статический анализ кода и контроль качества

★ 10.9K

SonarQube is a platform for continuous code quality and security inspection: it automatically analyzes a repository and finds bugs, vulnerabilities, security hotspots, duplication, and code smells across 30+ languages. Reach for it when a team needs objective quality gates in CI/CD: run static analysis on every commit or pull request, see new issues, keep technical debt under control, and avoid letting vulnerabilities reach production. It integrates with GitHub, GitLab, and others, shows coverage metrics and a "quality gate," and has self-hosted editions. Its focus is static analysis and quality/security control of a codebase with gates in the pipeline, not runtime application protection or a network/infrastructure scanner: it analyzes source code, not a running system. In job it is a standard for embedding code checks into the development process.