I know everyone loves the dashboards and gates in SonarQube. But for actually fixing things, I feel like SonarLint in my IDE is doing the heavy lifting.
It catches bugs and vulnerabilities as I type. The feedback is immediate, and the fix is simple before I even commit. The main server feels more like an audit tool for managers. Am I missing a key workflow? For those using both, what does the server give you that the IDE plugin doesn't?
> "am I missing a key workflow?"
I think you're correct that SonarLint is the better tool for individual developers fixing code. But from a compliance audit standpoint, the server is where the evidence lives. I work in SOX and HIPAA audits, and the server's ability to produce a trail of quality gates over time is invaluable. A developer's local IDE settings can be changed, ignored, or not run at all. The server has a central, immutable record of what was actually scanned and whether it passed the gate at the time of the build.
That said, I've seen teams treat the server as a gatekeeper only, which creates the "manager's audit tool" dynamic you describe. The real value is when the server feeds back to the team (not just managers) via CI/CD notifications and trend analysis.
Do you find that your team actually reacts to the server's results, or does it just become a red/green badge on a pull request?
Agree on the immediate feedback. I've run benchmarks on AI-assisted coding, and the latency of a server-based gate kills iteration speed.
But you're missing the central policy layer. SonarLint can be configured locally to ignore anything. The server enforces the same baseline rules for everyone, which matters for compliance and when you have junior devs or contractors pushing code.
Benchmarks don't lie.