Alright team, I've been deep in the trenches evaluating code quality gates for our CI/CD pipeline, and I think I've hit on a configuration that balances rigor with developer velocity. We're a 50-person DevOps team, so we need something that scales, integrates cleanly, and gives clear, actionable signals.
For us, the sweet spot with SonarQube has been a **multi-layered gate strategy**. A single, hard gate on "Blocker" issues is a recipe for pipeline frustration. Here's what we implemented:
* **Pipeline Stage 1 (PR Build):** A quality gate that fails on any new "Blocker" or "Critical" issues introduced. This is our first and most important line of defense. It prevents new debt from entering the codebase.
* **Pipeline Stage 2 (Nightly Main Branch Analysis):** A stricter gate that also fails if the overall project reliability or security rating degrades (e.g., from A to B). This lets us track long-term trends without blocking urgent daytime merges.
* **Key Metrics We Enforce:** Code Coverage on New Code (>80%), Duplicated Lines on New Code (<3%), and zero open Blocker issues. These thresholds are team-agreed.
The pitfall we avoided was gating on the *total* number of issues in a large legacy codebase. That's a non-starter. The focus on **New Code** is what makes this sustainable. We also had to carefully tune the "Leak Period" in the project settings to match our release cycles.
My question for the community: How are you handling the **severity mix** in your gates? Have you found success with gating on the security rating specifically, or is a blend of reliability and security better? I'm also curious about integration pain points with orchestration tools like ArgoCD or Jenkins.
Cheers,
Henry
Cheers, Henry
I'm the lead platform engineer at a fintech with about 60 devs. We run both SonarCloud (for newer services) and Checkov for IaC scanning in prod.
**Mid-market tax**: SonarQube's real licensing cost hits you at our size. The cloud version is roughly $15/dev/month for the mid-tier, but the self-hosted enterprise edition starts around $120k/year. The "free" Docker image is a demo trap; it doesn't scale for 50 people.
**Integration debt**: Everyone talks about the plugin, but the real effort is maintaining the quality profile and exclusions across 100+ repos. It's a part-time job for a senior engineer for the first 3 months. If you let each team set their own rules, the signal is worthless.
**Where it breaks**: The analysis is slow for monorepos. A large pull request can take 12+ minutes just for the Sonar scan, which blows your PR feedback loop. You'll need to run it on dedicated, powerful runners, which is another hidden infra cost.
**Clear win**: For security and reliability ratings on *new* code, it's the standard for a reason. The PR decoration showing new issues is the only thing developers actually look at. If your goal is to stop new critical bugs, it works.
My pick is SonarQube, but only if you have the platform team bandwidth to own and govern it centrally. If you don't, tell us your average PR size and whether you have a dedicated tools team.
Ask me about the cancellation process.