Overview
This course explains why SonarQube's rule-based analysis and Gitar's context-aware review work together as complementary layers of code verification, rather than one replacing the other. Through a worked example, it shows how Gitar catches intent-based flaws that pass SonarQube's checks, then drafts and verifies a fix — closing the loop from detection to a merge-ready solution.
Learning objectives
After completing this course, you’ll be able to:
- Describe the multi-layer verification model.
- Define how SonarQube and Gitar work together.
- Position Gitar as an additional layer of code security, not a replacement.
Key topics
- SonarQube's deterministic and Gitar's non-deterministic analysis
- Multi-layer verification
- PR/MR workflows
Target audience
- Administrators
- Analysts
- Developers
- DevOps engineers
- Engineering leaders
- Stakeholders
Prerequisites
- Familiarity with Git (commits, branches, diffs) and the PR/MR workflow
- Familiarity with the PR/MR workflow on your code host (GitHub, GitLab, or similar)