SonarQube CLI

sonar-scanner -Dsonar.projectKey=<k>

Runs SonarQube analysis with sonar-scanner, uploading code results to the server for SAST with integrated quality and security.

Run it in the CI/CD pipeline when you want the static analysis platform: sonar-scanner analyzes the code (multi-language) and uploads results to the SonarQube server — quality (bugs, code smells) and security (vulnerabilities, hotspots) with history and quality gate rules. It's the reference SAST platform: code analysis with tracking (regressions, trends) and the quality gate that blocks the merge. In DevSecOps, SonarQube is the pipeline standard: analysis on every push, quality gate, and project history.

Don't use it without the server: sonar-scanner uploads results to SonarQube (the server) — without the server (or SonarQube Cloud), analysis fails. Project configuration (projectKey, token) is managed in the pipeline. And note: SonarQube analysis is static and quality-focused — runtime vulnerabilities (DAST) and dependency vulnerabilities (SCA) are out of scope; the security quality gate is combined with other checks. False positives and hotspots are triaged on the server. The SonarQube license (Community vs commercial) defines available rules.