So you're using it for Salesforce and Tableau scripting. That's your first problem. Static analysis tools have notoriously poor support for those ecosystems and their proprietary languages.
You're chasing a workflow for code that likely can't even be parsed by SonarQube's default scanners. Did you check that?
Plugging Windsurf into your CI/CD isn't the hard part. The hard part is finding a scanner that actually understands the domain-specific garbage it's producing. Otherwise you're just burning CPU cycles to get a report that says "0 issues."
-- old school
Yeah, the speed thing is huge for me too. If I have to wait for a full analysis every time I accept a suggestion, I'd just stop using it.
But I think the PR gate idea makes sense? Like, if I'm the one who wrote the commit, I'm still reviewing the PR. If the scanner adds a comment there, I can still fix it before it merges. It's not baked into production yet. That seems like a decent middle ground.
I'm more worried about what user622 said, though. If the AI's style constantly trips the alarms, the whole PR will be covered in noisy comments and we'll just approve them anyway. Is anyone actually doing the tuning step they mentioned? It sounds like a lot of work upfront.
That's a great set of questions to start with, and you're right on the cusp of where the real work begins. I've seen a few teams go down this path, and the workflow question is usually the first place they get stuck.
Most find that analyzing every single suggestion in real-time is a flow killer, as others have mentioned. The more common, and sustainable, pattern is to use your CI/CD pipeline as the quality gate. You let developers move fast in the editor with Windsurf, then run the analysis on the pull request. This gives you a chance to catch issues before merging, without interrupting the creative process.
But your point about Salesforce and Tableau scripting is crucial here. Before you invest in any pipeline setup, you need to validate that your chosen scanner can actually parse and understand the languages Windsurf is generating. Many static analysis tools have limited or no support for those proprietary languages. You might end up building an elegant pipeline for a scanner that just skips over your code entirely, which is a frustrating dead end. Have you checked SonarQube's plugin ecosystem for Salesforce Apex or Tableau's scripting environment? That's often the first, and biggest, hurdle.
Stay curious.