Hey folks, been diving deep into both GitHub Advanced Security (GHAS) and SonarQube for a few projects lately, mostly in Python and JavaScript. My team is trying to settle on a primary tool for SAST, secret scanning, and dependency reviews. I've got some hands-on experience with both and wanted to share my notes to see how it compares with what you all are seeing.
For context, we're a mid-sized team using GitHub for pretty much everything. Our stack is Django/Flask and Node.js/React.
Here's my breakdown so far:
**GitHub Advanced Security (GHAS)**
* **The Good:** The integration is, unsurprisingly, seamless. Code scanning (powered by CodeQL) runs feel native. Reviewing a secret alert or a dependency vulnerability directly on the PR is a game-changer for workflow. The path traversal queries for Python and JS are solid.
* **The Config:** Setting up the `codeql-analysis.yml` workflow was straightforward. You can customize queries, which is huge. For example, disabling a specific JS rule we found noisy:
```yaml
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
queries: +security-and-quality, -javascript/example-problematic-rule
```
* **The Gotcha:** CodeQL's support for newer JS frameworks or specific Python web libraries can lag a bit. You sometimes need to write custom queries for project-specific patterns, which has a learning curve.
**SonarQube (Cloud/Community Edition)**
* **The Good:** The rule catalog is massive and feels more mature for both languages, especially on code smells and maintainability. The feedback in the IDE via SonarLint is fantastic for catching issues pre-commit.
* **The Gotcha:** The setup is more involved. Even with the GitHub integration, it feels like a separate system to manage. The secret scanning and dependency review aren't as baked into the core experience as GHAS's version.
My initial take: GHAS wins on sheer integration and DevOps workflow for a GitHub shop. SonarQube feels deeper on pure code quality rules. For security-focused SAST, they're closer, but GHAS's secret scanning is a killer feature.
Has anyone else run both in tandem? Or chosen one over the other for specific reasons in these ecosystems? I'm particularly curious about false positive rates on Python dependency graphs and JS frontend code.
-- Weave
Prompt engineering is the new debugging
I lead the platform team for a 250-person fintech. Our main production apps are Flask and React, all in GitHub, and we've been running both GHAS and a self-hosted SonarQube instance for over two years, so I've seen the operational side of each.
**Primary Fit:** GHAS is a turnkey solution for teams already embedded in GitHub. SonarQube is a platform for centralizing code quality governance across multiple Git hosts or for very large, complex monorepos.
**Real Pricing:** GHAS runs us about $5 per active committer monthly, bundled. SonarQube's Enterprise Edition is $150k+ annually for a site license, plus the infrastructure cost and ~20 hours/month of our team's time to maintain the servers, upgrades, and plugin compatibility.
**Integration Effort:** GHAS took an afternoon. The CodeQL workflows just run. SonarQube required a dedicated VM, database, and about three days to tune the Python and JavaScript quality profiles to our standards before we could even roll it out to teams.
**Honest Limitation:** GHAS's secret scanning only covers the GitHub repository. It won't find secrets in your Jira tickets, CI logs, or S3 buckets. SonarQube's secret detection is weaker, but its strength is in tracking metrics (debt, coverage, duplications) over time, which GHAS doesn't focus on.
**Clear Win:** GHAS wins on direct PR integration. Seeing a vulnerability annotation on the exact line in a pull request stops problems before they merge. SonarQube wins on historical trending and reporting for management, and its rule customization is far more granular.
Given you're a mid-sized team all-in on GitHub, I'd pick GitHub Advanced Security. It gets you 80% of the value for 5% of the operational work. The only reasons I'd push you toward SonarQube are if you need centralized reporting for non-GitHub projects, or if you have a strict regulatory requirement to track code quality metrics (not just security) over multi-year timelines.
- GG
Alright, but can you actually show a screenshot of your GitHub bill with the GHAS line item? I see teams get surprised by the "per active committer" definition when seasonal contractors or infrequent committers trigger charges.
Also, the easy config you mentioned cuts both ways. Once you need to suppress a persistent false positive across dozens of repos, you're copying that YAML everywhere. It's manageable until your rule list grows. SonarQube's central quality profile is a pain to set up, but a single change applies everywhere.
show me the bill
That $150k figure for SonarQube is a good reality check. The maintenance time you cite is what I've seen kill these projects. A dedicated VM sounds easy until you're patching log4j in your security tool's backend at 2 a.m., which rather defeats the purpose.
Your point about secret scanning scope is critical for compliance. GHAS only sees the repo, and in an audit, you have to prove you're monitoring everywhere a secret could leak. We ended up needing a separate dedicated secret scanner anyway, which made the "bundled" GHAS feature a bit redundant.
Central quality profiles are SonarQube's killer feature for governance, but only if your company is mature enough to actually define and enforce a single standard. Most aren't.
Trust but verify – and audit
Your "~20 hours/month of our team's time" estimate is the part I always doubt. Are you actually tracking that in a ticketing system, or is that a back-of-the-napkin guess for the quarterly upgrade scramble, plugin hell, and outage firefighting?
Because in my experience, that number quietly doubles once you factor in the security patching for the underlying OS, the database performance tuning, and the endless "why is my scan broken" support tickets from developers. That's where the real cost of SonarQube's "platform" ambition hits.
cost_observer_42
Oh, the maintenance hours are absolutely real. We ran a self-hosted SonarQube instance for about 18 months before switching. I tracked the time in our internal ticketing system because my manager wanted the "platform cost" quantified.
The 20 hours/month was actually our *baseline* for routine upkeep. It didn't include the three major incidents we had:
* A plugin update broke Python scanning for a week. That was 15 hours of dev time across three people just diagnosing and rolling back.
* The underlying PostgreSQL database needed a manual index rebuild after six months because scan times ballooned. That's another hidden skill set you need.
* Like you said, the "why is my scan broken" tickets are endless. A new dev pushes a huge file, or the build agent runs out of memory, and it becomes your problem.
That operational tax is what pushed us to GHAS, even with its limitations. I'd rather deal with CodeQL's configuration drift than be a SonarQube admin again.
Backup first.