Skip to content
sonarqube-scan logo

SonarQube Code Analysis

sonarqube-scan

Run SonarQube/SonarCloud static code analysis to check code quality, detect security vulnerabilities, code smells, and bugs. Use when the user mentions SonarQube, code quality analysis, security scanning, static analysis, or wants to check for vulnerabilities.

mattnigh/skills_collection0installs24stars

SKILL.md

Full skill instructions

SonarQube Code Analysis

This skill runs SonarQube/​SonarCloud scans on your Python web application to analyze code quality, detect security vulnerabilities, and identify code smells.

When to Use This Skill

Use this skill when you need to:

  • Run a SonarQube or SonarCloud scan
  • Check code quality metrics
  • Find security vulnerabilities
  • Detect code smells and bugs
  • Generate static analysis reports
  • Review code coverage and technical debt

Prerequisites

Before running a scan, ensure:

  1. Python and pip are installed
  2. Project is configured with SonarQube/​SonarCloud credentials
  3. Internet connection is available for uploading results

How to Run a Scan

Windows (PowerShell)

Run the PowerShell script:

powershell.exe -ExecutionPolicy Bypass -File .claude/​skills/​sonarqube/​scripts/​run_sonar_scan.ps1

Linux/​Mac (Bash)

Run the bash script:

bash .claude/​skills/​sonarqube/​scripts/​run_sonar_scan.sh

What the Scan Does

  1. Installs pysonar - Automatically installs the SonarQube scanner for Python
  2. Runs analysis - Scans all Python files in the project
  3. Uploads results - Sends results to SonarCloud for analysis
  4. Generates report - Creates a detailed quality report with:
    • Code quality metrics
    • Security vulnerabilities
    • Code smells
    • Bugs and issues
    • Technical debt
    • Code coverage

Understanding Results

After the scan completes:

  • Visit your SonarCloud dashboard to view results
  • Check the console output for immediate feedback
  • Look for critical issues flagged during the scan

For detailed configuration options, see REFERENCE.md.

Troubleshooting

Issue: pysonar installation fails

  • Check your Python and pip installation
  • Ensure you have internet connectivity
  • Try manually installing: pip install pysonar

Issue: Authentication error

  • Verify your SonarQube token is valid
  • Check project key and organization are correct
  • See REFERENCE.md for credential configuration

Issue: Scan timeout

  • Large projects may take several minutes
  • Check network connectivity
  • Review SonarCloud service status

Next Steps After Scanning

  1. Review the SonarCloud dashboard
  2. Address critical security issues first
  3. Fix bugs and code smells
  4. Monitor code quality trends over time
  5. Integrate into CI/​CD pipeline for automated scanning

More skills from mattnigh

spring-framework-patterns logo
mattnigh/skills_collection

spring-framework-patterns

Comprehensive Spring Framework and Spring Boot best practices including dependency injection patterns, bean lifecycle and scopes, REST API development, Spring Data JPA, service layer design, Spring Security, testing strategies, caching, AOP, async processing, error handling, and common anti-patte...

24 0
View

TypeScript厳格モードによる型安全性設計を専門とするスキル。 📖 参照書籍: - 『Effective TypeScript』(Dan Vanderkam): 型設計 📚 リソース参照: - `resources/Level1_basics.md`: レベル1の基礎ガイド - `resources/Level2_intermediate.md`: レベル2の実務ガイド - `resources/Level3_advanced.md`: レベル3の応用ガイド - `resources/Level4_expert.md`: レベル4の専門ガイド - `resources/di...

24 0
View
deploying-cloud-k8s logo
mattnigh/skills_collection

deploying-cloud-k8s

Deploys applications to cloud Kubernetes (AKS/GKE/DOKS) with CI/CD pipelines. Use when deploying to production, setting up GitHub Actions, troubleshooting deployments. Covers build-time vs runtime vars, architecture matching, and battle-tested debugging.

24 0
View
moai-alfred-agent-guide logo
mattnigh/skills_collection

moai-alfred-agent-guide

19-agent team structure, decision trees for agent selection, Haiku vs Sonnet model selection, and agent collaboration principles. Use when deciding which sub-agent to invoke, understanding team responsibilities, or learning multi-agent orchestration.

24 0
View
mermaid-diagram-generator logo
mattnigh/skills_collection

mermaid-diagram-generator

Converts architecture descriptions, module specs, or workflow docs into Mermaid diagrams. Use when visualizing brick module relationships, workflows (DDD, investigation), or system architecture. Supports: flowcharts, sequence diagrams, class diagrams, state machines, entity relationship diagrams,...

24 0
View
pre-flight-check logo
mattnigh/skills_collection

pre-flight-check

INVOKE FIRST before any code work. Validates git workflow (branch, issue, worklog) and checks approach. Use at START of every task and END before completing. Prevents skipped steps.

24 0
View
browser-dev-tools logo
mattnigh/skills_collection

browser-dev-tools

This skill should be used when working with browser-rendered artifacts (i.e. Bun, React/React Native) to proactively validate that development work on localhost is being built appropriately and to support debugging browser-rendered content. Use this skill after making frontend changes to verify t...

24 0
View
lead-dev logo
mattnigh/skills_collection

lead-dev

Lead Développeur - Coordination technique opérationnelle, code review, mentoring et livraison. Pair de web-dev-process au niveau OPÉRATIONS.

24 0
View
worker-monitor logo
mattnigh/skills_collection

worker-monitor

Monitor Docker workers, RQ queue health, and auto-scale workers (max 4). Use when: checking job progress, monitoring queue depth, scaling workers up/down, diagnosing slow processing, or waiting for jobs to complete. Referenced by data-quality skill during reprocessing.

24 0
View
quality-advisor logo
mattnigh/skills_collection

quality-advisor

Proactive quality guidance system that monitors artifact creation and provides real-time feedback on documentation quality

24 0
View
bump-version logo
mattnigh/skills_collection

bump-version

This skill should be used when the user wants to bump the version number in the workspace. It updates versions across all pyproject.toml files (root, tde, and tda packages) and the CHANGELOG.md to keep them synchronized.

24 0
View

Popular AI tools

Kaiber logo
Video

Kaiber

Generate, edit, and beat-sync AI video with leading models in one workspace.

Paid
View
Vimcal logo
Productivity

Vimcal

The world's fastest calendar for remote work

Free
View

Transform Your Design with AI Designer by ImgCreator.ai

Freemium
View
Akool AI logo
Content & writing

Akool AI

Revolutionizing Video Production with AI-Powered Creativity

Paid
View

Extend an image past the frame and let AI fill the new aspect ratio.

Freemium
View
StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
C

ChainClarity explains 700+ crypto whitepapers in plain English, with layered summaries, comparisons, research tools, alerts, and a $4.99 Pro plan.

Freemium
View
Opus Clip logo
Coding & apps

Opus Clip

Opus.ai: Revolutionize Your Web Experience

Free
View