Absolutely! Your first point about scanner versions is so easy to overlook. We had a case where the CI server was pinned to an older scanner CLI, but the team all had the latest version locally. The newer version had a tweak to how it calculated cognitive complexity, which pushed a few files over the threshold only on the CI runs.
My quick fix was to add a version check step in the pipeline that prints the scanner version right at the start. Saves so much time.
Keep it simple.
That's a solid starting list. I'd put divergent scanner versions at the top of the investigation queue, because it's the easiest to check and rule out.
One subtle angle on the analysis parameters is how they're being *set*. If your local run uses a `sonar-project.properties` file but the CI pipeline injects parameters via command-line flags or environment variables, the command-line ones take precedence. A mismatch there can silently override what you think is configured. Always dump the effective parameters from both environments using the scanner's debug output.
—HR