SonarQube
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
What SonarQube is
SonarQube is a static analysis platform for code quality and security. Its analysis applies symbolic execution plus data-flow and control-flow techniques. Findings cover bugs, security vulnerabilities and hotspots, maintainability issues, and coverage on new code. It analyzes more than 40 programming languages and frameworks. This repository contains the SonarQube Community Build, the open source edition of the platform. Quality Gates apply a pass or fail check to new code in pull requests and pipelines. The server is built with Gradle and started from a zip distribution on Linux, macOS or Windows. Commercial editions add more languages, branch and pull request analysis, taint analysis, and secrets detection.
Written from the project's README, read .
- Category
- Code quality and static analysis
- License
- LGPL-3.0
- Language
- Java
- Changelog
- Releases on GitHub
Repository metrics
Status
activeLast commit within 90 days of the fetch date.Computed from the last commit date and the archive flag on the fetch date. See the status rules.
Alternatives
Listed code quality and static analysis tools, same primary language first, then by GitHub stars. Each line gives one fact from the tool's documentation where it differs from SonarQube's, with its source.
Checkstyle: Languages or files analysed: Java source code. source: Docs: Checkstyle home
SpotBugs: Languages or files analysed: Java programs. source: Docs: Introduction
Ruff: Languages or files analysed: Python files (*.py, *.pyi), Jupyter Notebooks (*.ipynb) and pyproject.toml. source: Docs: Configuring Ruff
ShellCheck: Languages or files analysed: Shell scripts in the sh, bash, dash, ksh and BusyBox dialects. source: Docs: shellcheck(1) manual
ESLint: Languages or files analysed: ECMAScript/JavaScript code; JSX parsing when enabled. source: README
mypy: Languages or files analysed: Python programs with type hints. source: README
golangci-lint: Languages or files analysed: Go code. source: README
Semgrep: Languages or files analysed: Community supported in Semgrep CE: C/C++, C#, Go, Java, JavaScript, TypeScript, Kotlin, Python, Ruby, Rust, PHP, Scala, Swift, Terraform. source: Docs: Supported languages for Semgrep Community Edition (CE)
Questions
Is SonarQube open source?
Yes. SonarQube is released under LGPL-3.0, an OSI-approved license, as reported by the GitHub API on 2026-09-22.
Is SonarQube maintained?
On 2026-09-22, the last commit to the default branch was on 2026-09-21, so the listed status is active. Rule: Last commit within 90 days of the fetch date.
How many GitHub stars does SonarQube have?
11,010 stars on 2026-09-22, from the GitHub API. The number is refreshed at each monthly update.
What language is SonarQube written in?
The repository's primary language, as reported by the GitHub API, is Java.
Sources
- GitHub REST API: repository, read
- GitHub REST API: commits, read
- GitHub REST API: latest release, read
- GitHub REST API: contributors, read
- README, read