starter.wiki

Centralized non-security code-quality governance

SonarQube

A centralized analysis and quality-gate platform used here only for maintainability, reliability, duplication, coverage, and code-quality governance across repositories.

Visit official site

Editorial verdict

Choose SonarQube when centralized non-security quality profiles and gates provide real organizational value beyond repository-local linters, and the team can operate or fund the platform.12

Best for

  • Multi-repository quality governance
  • Shared maintainability and reliability profiles
  • Organizations needing centralized non-security quality gates
12

Not ideal for

  • Small repositories served by local linters
  • Security vulnerability scanning as the primary intent
  • Teams unable to govern false positives, upgrades, compute, and licensing
12
Main trade-off

Central governance adds cross-repository consistency while increasing administration, integration, compute, licensing, rule tuning, and false-positive management.12

Product boundary

Whether centralized multi-language quality profiles, reporting, and non-security quality gates justify a server or managed platform.

This page evaluates SonarQube only for non-security code quality: maintainability, reliability, duplication, coverage, and quality gates. Security hotspots, SAST, SCA, container, and IaC findings belong to Security → Vulnerability Scanning.12

For: Larger engineering organizations governing maintainability and correctness across repositories and teams

  • Repository-local linting is sufficient
  • Security analysis becomes the primary decision
  • Code-volume, deployment, support, or governance cost does not fit

Why teams consider SonarQube

  • Central quality profilesOrganizations can govern non-security quality rules across repositories.12
  • Quality gatesMaintainability, reliability, duplication, and coverage conditions can inform delivery policy.12
  • Multi-language reportingA shared platform aggregates quality findings across supported languages and teams.12

Pricing

Sonar publishes free and commercial SonarQube routes whose cost and features vary by product, deployment, code volume, users, support, and enterprise scope.2

Current decision boundary

Free and commercial SonarQube routes

Verified 2026-07-27: Sonar's official pricing separates free and commercial products and plans; estimate code volume, deployment, users, support, and governance without importing security-product claims into this route.2

Primary dimensions
Product, deployment, code volume, users, and support2
Quality scope
Maintainability, reliability, duplication, coverage, and quality gates2
Security boundary
Vulnerability decisions remain in the Security Category2
Pricing checked View official pricing

SonarQube vs alternatives

ESLint

Choose when
JavaScript and TypeScript linting
Avoid when
Python repositories
Compared with SonarQube
Configurability and ecosystem breadth improve fit while configuration, plugin compatibility, performance, rule overlap, and upgrades remain team work.34

Biome

Choose when
Supported web-language repositories
Avoid when
Repositories dependent on unsupported ESLint plugins
Compared with SonarQube
Consolidation and speed reduce toolchain work while accepting a narrower language, rule, plugin, and compatibility surface.56

Ruff

Choose when
Python linting
Avoid when
Non-Python repositories
Compared with SonarQube
Speed and consolidation improve feedback while rule compatibility, formatter differences, configuration, migration, and missing semantic analyses require review.78

Resources and sources

Official product, pricing, license, and operating sources

  • SonarQube Server documentation
    Open
  • Sonar plans and pricing
    Open
  • ESLint getting started
    Open
  • ESLint repository and license
    Open
  • Biome getting started
    Open
  • Biome repository
    Open
  • Ruff documentation
    Open
  • Ruff repository and license
    Open
  1. 1
    SonarQube Server documentation

    Sonar · Accessed Official

  2. 2
    Sonar plans and pricing

    Sonar · Accessed Official

  3. 3
    ESLint getting started

    ESLint · Accessed Official

  4. 4
    ESLint repository and license

    ESLint · Accessed Official

  5. 5
    Biome getting started

    Biome · Accessed Official

  6. 6
    Biome repository

    Biome · Accessed Official

  7. 7
    Ruff documentation

    Astral · Accessed Official

  8. 8
    Ruff repository and license

    Astral · Accessed Official