TLDR overview
- Checking code quality using SonarQube means running continuous automated code verification that surfaces bugs, vulnerabilities, security hotspots, code smells, and architecture issues across your codebase.
- Poor quality checks let defects and security risk reach production, where they cost far more to fix and slow every future release.
- SonarQube verifies the code in each pull request before merge and runs on every code commit in your CI/CD pipeline, so issues get caught early.
- SonarQube treats AI-generated code the same as human written code, holding all code to a single quality gate before it ships.
Code quality determines how reliable, secure, and maintainable your software is over time. As AI coding tools push more code into your repositories faster, the question of how to check that code has moved from a periodic chore to an automated continuous discipline.
This guide explains how to check code quality using SonarQube. It walks through setting up your first scan, deciding which quality metrics to review first, using quality gates for release decisions, and operationalizing checks across your CI/CD pipeline.
The steps apply whether your code is written by a software developer or generated by an agent. SonarQube holds all code to the same high standard.
How to check code quality using SonarQube
Checking code quality using SonarQube means running automated code verification against your source code to detect bugs, security vulnerabilities, code smells, and architecture issues, then measuring the results against a defined pass or fail standard.
The workflow is continuous, not a one-off review. SonarQube continuously reviews source code, analyzes each pull request before it is merged, and runs on every code commit in your CI/CD pipeline. Rather than auditing quality at the end of a release cycle, you check it at the moment code is written and committed to the repository.
In practice, this means you connect SonarQube to your repository, run an analysis, review the findings it surfaces, and enforce a standard that every change must meet. The rest of this guide breaks this down step by step.
How do I set up SonarQube for the first time?
Your first scan establishes the baseline SonarQube measures every future change against. Setting it up takes three moves: sign up, set up your organization, onboard your projects, and integrate within your CI/CD pipeline to automate code verification on every code change.
Step 1: sign up
Getting started is easy. Sign up for SonarQube Cloud using the login from your DevOps platform account.
Step 2: set up your organization
From there, set up your organization. Your organization in SonarQube Cloud contains the binding to your DevOps platform: GitHub, GitLab, Azure DevOps, or Bitbucket. If your company uses more than one DevOps platform or more than one organization in the same DevOps platform, you need to set up one SonarQube Cloud organization per platform or per organization in each platform.
Step 3: onboard your projects
Once your organization is set up, you need to onboard the projects from your DevOps platform. This links SonarQube directly to the code in your DevOps platform repositories. SonarQube looks at the code in your repositories, so there is no separate copy of your code to manage in SonarQube.
Step 4: integrate SonarQube into your CI/CD pipeline
Connect SonarQube to your CI pipeline to automatically review project branches and pull requests. Once wired in, analysis runs without a manual trigger, every code change from both agents and humans is verified as part of your normal workflow.
What does SonarQube find when verifying code quality?
Once your first scan completes, SonarQube surfaces findings across several categories. Reviewing them in order of impact keeps you focused on what actually threatens a release.
SonarQube continuously reviews source code to uncover the following:
Start with bugs and security vulnerabilities, because these carry the highest risk of a production incident or exploit. Code smells and architecture issues come next. They rarely break a release on their own, but if left unaddressed they contribute to your technical debt that slows future changes.
What is a quality gate in SonarQube and how does it work?
A quality gate is the pass or fail standard that turns raw findings into a clear release decision. Instead of eyeballing a list of issues, you let a defined standard decide whether code is ready to ship.
Quality gates use quality profiles and integrate into your CI/CD pipeline to block substandard code on every code change. They automatically block pull requests and branches with issues from reaching production, so only reliable, secure, and maintainable code is released. The decision is enforced within your normal pipeline, not left to memory or manual sign-off.
SonarQube Cloud includes a built-in quality profile for each supported programming language, called the "Sonar way" profile, which activates a set of high coding standards applicable to most projects. That gives you a working code standard on day one, before you tune anything to your team's needs.
Use the quality gate as your merge criterion. If a pull request fails the quality gate, it does not get merged or reach production until the issues are resolved and the quality gate passes, even for agent generated pull requests and branches. This makes every release decision consistent across every contributor and every change.
How do I integrate SonarQube into my CI/CD pipeline?
A single scan tells you the state of your code once. Operationalizing checks means code is verified automatically on every change, so code health never drifts between reviews.
SonarQube is designed to integrate with CI/CD pipelines and DevOps tooling, verifying code every time it changes. It reviews each pull request before it is merged, which prevents issues from entering the codebase in the first place. The check moves left, from a late-stage audit to a gate on every contribution.
Once SonarQube is integrated into your CI pipeline, it automatically verifies new code added in project branches and pull requests without a manual step. The result is a repeatable loop: a developer or agent writes code, the pipeline runs the SonarQube code verification, the quality gate gives you clear pass/fail results to use for decision, and only passing code advances.
This is what makes checks durable at scale. As code volume grows, the process holds because it does not depend on anyone manually verifying code.
How SonarQube helps you check AI-generated code
SonarQube treats AI-generated code the same as developer written code. All new code meets the same quality and security standards, which means adopting AI tools does not create a separate, unverified category of code in your repositories.
Within the Agent Centric Development Cycle (AC/DC) framework there are three Guide, Verify, and Solve loops: the agentic loop, the CI verification loop, and the code maintenance loop. Each loop catches issues earlier than the one after it, and SonarQube together with Sonar Vortex, SonarQube Hunter Agent, and SonarQube Remediation Agent, runs in all three for a multilayered verification approach to checking AI-generated code.
Sonar Vortex shifts verification even further left into the agent loop, where code originates. There, it guides the agent with your standards and architecture, constrains it within your guidedrails, and verifies the code it generates before that code reaches your repository. The CI verification loop runs in the CI pipeline and checks all the new code in every pull request and branch. This is where SonarQube Server, SonarQube Cloud, and even SonarQube for IDE operate to ensure all new code is verified. SonarQube Remediation Agent and SonarQube Hunter Agent work autonomously in the code maintenance loop surfacing issues in the backlog of tech debt and offering verified fixes in new pull requests to be accepted by your team.
To get started, sign up for SonarQube Cloud with your DevOps platform login, import your repositories, and integrate SonarQube to your CI pipeline.
Additional SonarQube benefits
Beyond individual scans, SonarQube gives your team a consistent quality baseline that holds across contributors, languages, and code sources.
- One standard for all code. The same quality gate applies to developer-written and AI-generated code, so verification stays consistent as AI adoption grows.
- Analysis at every checkpoint. Checks run in each development loop: the agentic loop, the CI verification loop, and the code maintenance loop, in the IDE, on each branch and pull request, and on every code change, catching issues at the earliest point they appear.
- Built-in defaults. The "Sonar way" quality profile activates a working rule set for each supported language from the start, so you can check code before configuring anything.
- Pipeline-native enforcement. Quality gates block issue-laden code from reaching production automatically, making release decisions consistent rather than manual.