Automatic analysis for GitLab is now available

We are thrilled to announce that automatic analysis is now live for GitLab projects on SonarQube Cloud.

This zero-configuration feature enables SonarQube Cloud to audit your source code by interfacing directly with your GitLab instance. Once your project is added, the platform assesses compatibility and launches a scan without any manual pipeline setup. From that point on, every commit to the main branch or new merge request triggers an updated analysis. It is the fastest way for GitLab software developers to implement code security and quality gates without slowing down their velocity.

Expanding beyond our existing integrations, GitLab users can now enjoy the same seamless experience previously exclusive to GitHub and Azure Devops, bringing rapid actionable insights to the GitLab community.

What problems does setting up GitLab code analysis traditionally cause?

Traditionally, implementing deep code analysis on GitLab required managing GitLab Runners, tweaking .gitlab-ci.yml files, and ensuring environment variables were perfectly synced. For fast-moving teams or those new to the ecosystem, this overhead often created a bottleneck that delayed the adoption of critical code quality standards.                  

Automatic analysis changes the game by removing the need for CI management. By simply linking your GitLab account and choosing your repositories, SonarQube Cloud handles the heavy lifting. The system pulls code directly from GitLab, automating every step from the initial import to continuous monitoring of pull requests - no YAML knowledge required.

When should I use automatic analysis instead of CI-based analysis in SonarQube?

Automatic analysis is designed to get you to actionable insights as fast as possible. However, as your application grows in scale and complexity, transitioning to a CI-based pipeline within GitLab CI/CD is the suggested path for deeper customization.

When CI-based analysis is the better fit:

• Better dependency resolution: CI-based analysis provides deeper insights into your code and build environment, enabling it to detect issues and vulnerabilities with both public and in-house private dependencies, packages, and libraries that automatic analysis cannot see.
• Code coverage computation: Computing code coverage requires collecting code coverage reports generated by your tests. CI-based analysis enables you to analyze right after your tests have run providing you with fresh and accurate code coverage information. Because your tests will not be executed in automatic analysis, code coverage will not be computed. 
• Enhanced performance and control: By using compute resources tailored to your specific build and project, your analysis runs faster and can avoid timeout and memory constraints. Additionally, you gain the flexibility of being in control of how and where analysis runs: for example, analyzing non-main branches and monorepos, conditioning the run of the analysis, dimensioning the analysis step to run faster, accessing analysis logs, etc.

For more details, check the Automatic analysis documentation.

How do I get started with automatic analysis on SonarQube Cloud for GitLab?

For new projects:

1. Sign in to SonarQube Cloud and link your GitLab account. Ensure your access token permissions allow for repository and metadata reading.
2. Import the repositories you want to analyze.
3. For eligible repositories, automatic analysis starts immediately - no further configuration needed.
4. Results appear on the default branch and active pull requests shortly after import.

Existing CI-based projects are unaffected. They continue to run as before.

The bottom line

Leverage automatic analysis for immediate feedback loops, and evolve toward a CI-integrated setup as your GitLab project moves toward enterprise-grade production.

Try it on SonarQube Cloud

For setup details and the full list of supported languages, please refer to the documentation.