SonarQube: Quality Gates That Help, Not Hurt
Pragmatic quality policies that developers respect. Not boxes to check. Real insights, actionable feedback, faster delivery with confidence.
What we deliver with SonarQube
Quality gates on new code
Gates that judge what a pull request introduces rather than the legacy backlog, so the rule is achievable from day one.
Coverage wired correctly
Coverage reports uploaded from the real test run in CI, with an agreed scope, so the number reflects tested behaviour rather than a tool that ran.
Rule profiles per language
Curated profiles with project-specific exclusions, reducing noise to the findings a team will actually act on.
Security hotspots triage
A review routine with owners and an agreed response time, so hotspots are resolved rather than accumulating indefinitely.
Evidence and reporting
Dashboards that answer audit questions about code quality and remediation over time, per project and per team.
How we work with SonarQube
A quality gate that blocks every merge gets switched off within a month. We start from new code only: a clean baseline on legacy, incremental gates on new work, and an agreed list of blocking rules that is deliberately short.
Coverage is the most misused metric in the tool. We make sure it comes from the CI test run, exclude generated code, and treat it as a guide rather than a target to game.
SonarQube in production: where it breaks
The same handful of problems show up on almost every engagement. Naming them early is cheaper than discovering them at 2am.
Gates applied to the entire legacy codebase
Nobody can pass, so exceptions pile up and the gate loses meaning. Judging new code only keeps the signal credible.
Coverage numbers that mean nothing
Reports uploaded from the wrong step or double-counted. Fixing the pipeline wiring makes the metric trustworthy again.
Blanket rule sets
Thousands of findings nobody reads, including the two that matter. Profiles and exclusions per project bring focus.
When to use SonarQube
Regulated delivery needing evidence of code quality controls.
Legacy clean-up where a gradual ratchet beats a rewrite.
Teams whose static analysis is ignored because it is too noisy.