SonarQube & Atlassian – Code quality right from the start
Static code analysis, seamlessly integrated into your CI/CD pipeline and Jira
What is SonarQube?
Smarter Together – SonarQube + Atlassian
The integration of SonarQube into the Atlassian platform bridges the gap between code analysis and project management:
- Quality gate in the pipeline: With every commit, SonarQube automatically checks the code in Bitbucket Pipelines, GitLab CI or Jenkins. The results are fed straight back into Jira, so teams can quickly see where action is needed.
- Findings as Jira issues: Critical bugs and vulnerabilities are automatically converted into Jira issues. This allows them to be prioritised, assigned to the right people and tracked effectively.
- Pull request annotation: SonarQube displays analysis results directly within pull requests in Bitbucket. This allows developers to see relevant issues exactly where they arise during the code review.
- Branch analysis: Feature branches and pull requests are checked separately. This ensures issues are spotted early on, before they reach the main branch.
- Developer feedback with SonarLint: SonarLint provides developers with helpful, real-time feedback directly within the IDE – for example, in IntelliJ, VS Code or Eclipse – tailored to the central SonarQube rule set.
- Confluence reporting: Code quality metrics and trends can be easily embedded in Confluence pages. This ensures that technical stakeholders and management remain on the same page during reviews.
Clean Code – More than just a buzzword
SonarSource has introduced a paradigm shift with its ‘Clean as You Code’ approach: rather than tidying up all existing code in one go, the Quality Gate focuses exclusively on new and modified code.
Overview: The ‘Clean as You Code’ principle
Typical use cases
Scenario 1: Mandatory quality gates before every merge
A team agrees on clear quality rules – for example, 0 new bugs, 0 new vulnerabilities and more than 80% coverage on new code. As soon as a pull request fails to meet these requirements, it is not merged in the first place. SonarQube checks this automatically in the background, thereby relieving the team of a great deal of manual work.
Scenario 2: Systematically reducing technical debt
Technical debt can quickly become an abstract concept. SonarQube makes it tangible by reporting it as ‘Remediation Time’ in days. This enables teams to plan targeted technical debt sprints in Jira and then track the improvements made in SonarQube and Confluence.
Scenario 3: Security analysis in the development process
Security checks do not take place just before release, but right where the code is being written. SonarQube detects vulnerabilities in your own code based on the OWASP Top 10 and CWE – serving as a useful complement to Snyk for dependencies and Blue Flag for compliance. Relevant findings are added to the sprint as Jira tickets, where they can be prioritised.
Scenario 4: Consolidating multilingual projects
Many companies today work with mixed tech stacks – such as Java on the back end, React on the front end and Python for ML services. With a central SonarQube instance, all these projects can be analysed in one place, assessed against consistent quality gates and reported on centrally.
SonarQube compared – What is the added value?
Why Communardo?
We combine in-depth Atlassian know-how with sound SonarQube expertise, thereby seamlessly bringing both worlds together: from configuring analysis profiles to integrating them into existing CI/CD pipelines with Bitbucket, GitLab or Jenkins. Findings do not remain isolated within the tool, but are linked to Jira in such a way that teams can prioritise them, track them and incorporate them directly into their workflows.
Together, we develop quality gates that set clear standards without unnecessarily slowing down the development flow, and tailor rule sets specifically to your technologies, frameworks and compliance requirements. We also provide end-to-end support with licensing and operations – from the initial consultation through to setup and implementation, right up to a managed service if you wish to operate SonarQube long-term from a single source.
Who is SonarQube + Atlassian relevant for?
Licensing & Procurement
SonarQube is available in four editions – depending on team size, language requirements and hosting needs:
Alternatively: SonarCloud – the SaaS version of SonarSource, hosted and managed. Ideal for teams that do not wish to run their own server.
As a Communardo customer, you’ll benefit from:
- Advice on the right edition based on team size and tech stack
- Consolidated procurement alongside Atlassian licences
- Support with setup, integration and quality gate configuration
- Renewal management and proactive licence optimisation
FAQ
Yes – the tools complement each other. Snyk focuses on vulnerabilities in dependencies, containers and IaC. SonarQube analyses your own code for bugs, code smells and maintainability. Together, they cover the entire spectrum of code quality and security.
Absolutely. SonarQube integrates natively with GitLab CI, GitHub Actions, Bitbucket Pipelines, Jenkins and Azure DevOps. The Jira integration works regardless of which SCM/CI tool you use.
SonarQube is self-managed (or Data Centre), whilst SonarCloud is the SaaS version. Functionally, they are largely identical. SonarCloud is particularly suitable for teams that do not wish to run their own server.
As a rule, the basic integration can be completed in a few hours. A SonarQube scanner is added as a step in your CI/CD pipeline. Configuring quality gates and project profiles requires a little more fine-tuning – and we’re here to help you with that.
Yes. SonarQube Enterprise offers features such as regulatory reports (e.g. for the OWASP Top 10 and CWE/SANS Top 25), audit trails and role-based access control. This makes the platform suitable for regulated sectors such as financial services, healthcare and the automotive industry – particularly when used in conjunction with Blue Flag Security to demonstrate compliance.
Do you have any questions or would you like some advice from us?
Arrange a personal, no-obligation consultation with our Atlassian Sales Experts.
Your contact person
Marlen KaiserWe're happy to help you
- Kleiststraße 10a, 01129 Dresden, Germany
- Tel: 0800 8 776 776
- sales@communardo.de