Open-source DeepSource alternatives

SonarQube is a code quality and security platform. Its static analysis uses techniques such as symbolic execution and data and control flow analysis to inspect source code, find bugs and vulnerabilities, and explain what to fix and why. Results appear in the IDE, in pull requests and in CI pipelines.

This repository holds the source of the SonarQube Community Build, the free, open-source edition that shares the analysis used across the product line. It reports reliability bugs, security vulnerabilities and security hotspots, maintainability and structural issues, and coverage on new code. More than 40 programming languages and frameworks are covered, and the same code always produces the same findings.

The project positions itself as a verification step for code written by people or by AI agents before it merges. SonarQube is written in Java and licensed under LGPL-3.0. Commercial editions from SonarSource add further features, while the Community Build can be run on your own servers.

Reviewdog automates code review feedback by connecting to the linters and analysis tools you already use. It reads their output and posts findings as comments on code hosting services such as GitHub, GitLab and Bitbucket, but only when the finding falls in the lines changed by the patch under review.

Input can be any tool output described with errorformat patterns, plus the Reviewdog Diagnostic Format, checkstyle and SARIF formats, and it can also suggest code changes. It offers several reporters, including local output, GitHub PR checks, annotations and review comments, GitLab merge request discussions and Bitbucket Code Insights reports. It runs in CI services such as GitHub Actions, Travis CI, CircleCI, GitLab CI, Bitbucket Pipelines and Jenkins, and locally it can filter lint output by diff.

Reviewdog is written in Go and licensed under MIT, and works with any programming language since it only needs the output of the linter. Teams use it to keep a codebase healthy without flooding reviewers with warnings about code that was not touched.