Hi everyone, diving into the deep end here with a decision my team is wrestling with. We're a mid-sized team (about 15 devs) maintaining a legacy C++ codebase that's finally getting serious about static analysis. We've narrowed it down to SonarQube (self-hosted) and Coverity (likely the on-prem scan option), but the real-world cost/benefit is surprisingly fuzzy.
I've read the spec sheets, but I'm really looking for operational experience. For SonarQube, the setup seems straightforward, and I love the idea of having it integrated into our merge requests. But I've heard its C++ analysis, especially for deeper security flaws and complex data flow, might not be as battle-tested as Coverity's. Conversely, Coverity's reputation for depth is huge, but I'm wary of it being this heavyweight, expensive "scan event" we do every few weeks rather than something in the daily workflow. The pricing models are also night-and-day different.
My core questions are:
1. For a C++ project with a fair amount of legacy cruft, which tool actually gave you more *actionable* issues? We can't boil the ocean; we need to prioritize real risks.
2. What's the hidden cost in tuning? I've heard Coverity needs significant config to cut down the noise, while SonarQube might need rules tweaked to catch C++-specific pitfalls.
3. Did the integration into developer workflow (like SonarQube's PR decoration) actually increase fix rates, or did it just become background noise?
Really curious about the "velocity" aspect. We're trying to move faster, not add a bureaucratic step. Any war stories from similar-sized C++ shops would be gold.