Discover / Security
SonarQube
by SonarSourceJava
Continuous inspection of code quality and security across 30+ languages.
Maturity: stable because 16y old, 26.7.0.124771 released 26d ago. Derived from release and commit history, not a rating.
- Stars
- 11k
- Forks
- 2.2k
- Downloads / mo
- —
- Last commit
- 2026-08-01
- License
- LGPL-3.0
- Open issues
- 1
Market and trust evidence
Edition not yet matchedNo exact skills.sh identity match is available for this repository. Repository adoption and freshness remain visible above; install momentum is not inferred.
Trust analysis is a screening signal, not a security warranty. Read the ranking and trust methodology.
In practice
Written by AI from this repository’s README · medium confidenceCode quality drifts because nothing measures new problems separately from existing ones.
Use it when
When a team wants a quality gate on new code across projects with a self hosted server.
Not the right pick when
The README covers building from source only, and the project says it is not actively seeking feature contributions.
Capabilities
- Shows application health and newly introduced issues
- Quality Gate for systematically improving code quality
- Server distribution built through Gradle
- Start scripts for Linux, macOS and Windows
- Web UI maintained in a separate repository and pulled in at build time
Requirements
- Java 17 to build the project
- Native Git installed and available in PATH
Cost: Cost not stated
Video walkthroughs
SonarQube Tutorial: Everything You Need to Know for Beginners
How To Sonarqube Setup From Scratch And Code Analysis
Third-party YouTube uploads matched to this tool by title, channel and repository name on 2026-08-03. Not made, reviewed or endorsed by SkillPilot. View counts and publish months are as of the match date and the month is approximate. Nothing loads from YouTube until you press play.
What the repository ships
Detected from the actual files in the repository root.
Latest release 26.7.0.124771
Published 2026-07-08
See details in the community announcement, and more in the release notes.
Tags
README
SonarQube Build Quality Gate Status AI Code Assurance
Continuous Inspection
SonarQube provides the capability to not only show the health of an application but also to highlight issues newly introduced. With a Quality Gate in place, you can achieve Clean Code and therefore improve code quality systematically.
Links
- Website
- Download
- Documentation
- Webapp source code
- X
- SonarSource, author of SonarQube
- Issue tracking, read-only. Only SonarSourcers can create tickets.
- Responsible Disclosure
- Next instance of the next SonarQube version
Have Questions or Feedback?
For support questions ("How do I?", "I got this error, why?", ...), please first read the documentation and then head to the SonarSource Community. The answer to your question has likely already been answered! 🤓
Be aware that this forum is a community, so the standard pleasantries ("Hi", "Thanks", ...) are expected. And if you don't get an answer to your thread, you should sit on your hands for at least three days before bumping it. Operators are not standing by. 😄
Contributing
If you would like to see a new feature or report a bug, please create a new thread in our forum.
Please be aware that we are not actively looking for feature contributions. The truth is that it's extremely difficult for someone outside SonarSource to comply with our roadmap and expectations. Therefore, we typically only accept minor cosmetic changes and typo fixes.
With that in mind, if you would like to submit a code contribution, please create a pull request for this repository. Please explain your motives to contribute this change: what problem you are trying to fix, what improvement you are trying to make.
Make sure that you follow our code style and all tests are passing (Travis build is executed for each pull request).
Willing to contribute to SonarSource products? We are looking for smart, passionate, and skilled people to help us build world-class code-quality solutions. Have a look at our current job offers here!
Building
To build sources locally follow these instructions.
Requirements
- Java 17 - Required to build the project
- Native Git - Must be installed and available in your PATH
- Tests - Can be disabled if needed by adding
-x testto the gradle command (useful if you just want to build without running tests)
Build and Run Unit Tests
Execute from the project base directory:
./gradlew build
The zip distribution file is generated in sonar-application/build/distributions/. Unzip it and start the server by executing:
# on Linux
bin/linux-x86-64/sonar.sh start
# or on MacOS
bin/macosx-universal-64/sonar.sh start
# or on Windows
bin\windows-x86-64\StartSonar.bat
Open in IDE
If the project has never been built, then build it as usual (see previous section) or use the quicker command:
./gradlew ide
Then open the root file build.gradle as a project in IntelliJ or Eclipse.
Gradle Hints
| ./gradlew command | Description |
| -------------------------------- | ----------------------------------------- |
| dependencies | list dependencies |
| spotlessApply | fix source headers by applying HEADER |
| wrapper --gradle-version 5.2.1 | upgrade wrapper |
Building with UI changes
The SonarQube UI (or webapp as we call it), is located in another repository: sonarqube-webapp.
When building the sonarqube repository, the webapp is automatically downloaded from Maven Central as a dependency, it makes it easy for you to contribute backend changes without having to care about the webapp.
But if your contribution also contains UI changes, you must clone the sonarqube-webapp repository, do your changes there, build it locally and then build the sonarqube repository using the WEBAPP_BUILD_PATH environment variable to target your custom build of the UI.
Here is an example of how to do it:
cd /path/to/sonarqube-webapp/server/sonar-web
# do your changes
# install dependencies, only needed the first time
yarn
# build the webapp
yarn build
cd /path/to/sonarqube
# build the sonarqube repository using the custom build of the webapp
WEBAPP_BUILD_PATH=/path/to/sonarqube-webapp/server/sonar-web/build/webapp ./gradlew build
You can also target a specific version of the webapp by updating the webappVersion property in the ./gradle.properties file and then building the sonarqube repository normally.
Translations files
Historically our translations were stored in sonar-core/src/main/resources/org/sonar/l10n/core.properties, but this file is now deprecated and not updated anymore.
Default translations (in English) are now defined in the webapp repository, here:
https://github.com/SonarSource/sonarqube-webapp/blob/master/libs/sq-server-shared/src/l10n/default.ts
The format has changed but you can still have it as a .properties file format by running the following command:
cd /path/to/sonarqube-webapp/server/sonar-web
# install dependencies, only needed the first time
yarn
# generate a backward compatible .properties file with all the translation keys
yarn generate-translation-keys
Note that contributing extensions for translations into other languages still work the same way as before. It's just the source of truth for the default translations that changed.
License
Copyright (C) SonarSource Sàrl.
Licensed under the GNU Lesser General Public License, Version 3.0