SonarQube is overkill for a lot of projects. If you're mainly dealing with Python and JS, you can get better results with simpler, faster tools.
For Python:
* **Ruff** for linting and formatting. Blazing fast, all-in-one.
* **Bandit** specifically for security. SonarQube's security rules aren't great.
```bash
# Install and run
pip install ruff bandit
ruff check .
bandit -r .
```
For JavaScript/TypeScript:
* **ESLint** with the typescript-eslint parser. It's the standard.
* **Prettier** for formatting.
* **OWASP ZAP** or `npm audit` for dependency vulns, not SonarQube.
Combine them in your CI. You'll get faster feedback and fewer false positives.
Biggest gotcha: SonarQube's quality gates often block on meaningless style issues. These tools let you focus on real bugs.
metrics not myths
You're spot on about the speed and simplicity of these dedicated tools. I've seen teams spend weeks tuning SonarQube's quality gates for Python, only to realize they're just fighting its Java-centric rule set.
One thing I'd add: if you're in a mixed project, consider setting up a unified reporting step in your CI pipeline. You can have Ruff and ESLint output results in a standard format like SARIF, then combine them into a single dashboard view. It prevents the "six different tools, six different outputs" problem that sometimes comes with this approach.
And totally agree on the false positives - SonarQube flagging a missing Javadoc comment on a Python function is a special kind of frustration.
The right tool saves a thousand meetings.
Yeah, the unified reporting tip is great. I've been trying to set up a Grafana dashboard to visualize these linting results. Could you share an example of how you pipe the SARIF output into something like Prometheus? I'm still figuring out the metrics part. 😅
That's really helpful, thanks. I've been looking at Ruff since our Python builds are slow.
How do you handle the formatting part with Ruff? I see you mentioned it's all-in-one for linting *and* formatting, but is its formatter stable yet compared to something like Black? I'm a bit hesitant to switch our whole team over if the formatting rules are still changing.