Open-source SonarQube Cloud alternatives

Semgrep is a lightweight static analysis tool that searches code, finds bugs and enforces secure guardrails and coding standards. It supports more than 30 languages and can run in an IDE, as a pre-commit check or inside CI/CD workflows. The core engine is released under the LGPL-2.1 license.

It works like a semantic grep for code. Rules are written to look like the source code developers already write, so matching a pattern does not require abstract syntax trees, regular expressions or a separate query language, and a search for a value can match code that computes it. The aim is to find variants of a known bug quickly.

The Community Edition analyzes code within a single function or file, which the maintainers note means it will miss many true positives for security work. For SAST, software composition analysis and secrets scanning they recommend the commercial Semgrep AppSec Platform, which adds cross-file and data-flow analysis, AI-assisted triage and managed rule sets.

SonarQube is a code quality and security platform. Its static analysis uses techniques such as symbolic execution and data and control flow analysis to inspect source code, find bugs and vulnerabilities, and explain what to fix and why. Results appear in the IDE, in pull requests and in CI pipelines.

This repository holds the source of the SonarQube Community Build, the free, open-source edition that shares the analysis used across the product line. It reports reliability bugs, security vulnerabilities and security hotspots, maintainability and structural issues, and coverage on new code. More than 40 programming languages and frameworks are covered, and the same code always produces the same findings.

The project positions itself as a verification step for code written by people or by AI agents before it merges. SonarQube is written in Java and licensed under LGPL-3.0. Commercial editions from SonarSource add further features, while the Community Build can be run on your own servers.

Reviewdog automates code review feedback by connecting to the linters and analysis tools you already use. It reads their output and posts findings as comments on code hosting services such as GitHub, GitLab and Bitbucket, but only when the finding falls in the lines changed by the patch under review.

Input can be any tool output described with errorformat patterns, plus the Reviewdog Diagnostic Format, checkstyle and SARIF formats, and it can also suggest code changes. It offers several reporters, including local output, GitHub PR checks, annotations and review comments, GitLab merge request discussions and Bitbucket Code Insights reports. It runs in CI services such as GitHub Actions, Travis CI, CircleCI, GitLab CI, Bitbucket Pipelines and Jenkins, and locally it can filter lint output by diff.

Reviewdog is written in Go and licensed under MIT, and works with any programming language since it only needs the output of the linter. Teams use it to keep a codebase healthy without flooding reviewers with warnings about code that was not touched.