Menu

Individual skill

sonarqube-ai-slop-gate

Corrects the wrong defaults a model has when standing up self-hosted SonarQube Server as a continuous gate on AI-generated code, verified against docs.sonarsource.com in July 2026 (Server 2026.3, LTA 2026.1). Use when configuring SonarQube, designing a quality gate, or wiring a scan step into CI for AI-assisted work. Covers the setups that run green while measuring almost nothing — the fudge factor skips duplication and coverage conditions below 20 new lines and is on by default; duplication is never measured on test code; no `new_cognitive_complexity` metric exists to gate on; `sonar.host.url` now defaults to sonarcloud.io rather than localhost; a shallow clone degrades new-code attribution to timestamps. Also covers AI Code Assurance — the project flag, gate qualification, the deprecated Copilot autodetection — and that Community Build cannot analyze pull requests at all. NOT for SonarQube Cloud, IDE connected mode, or authoring custom analyzer rules.

skills/.experimental/sonarqube-ai-slop-gate/SKILL.md

Read pinned source

Source commit cf93c57cac89d6fc3e4194686000411567f5caf3

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Network or broad shell
Last checked
Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
221
Repository last updated
Aug 15, 2026
License
MIT

Observed agent integration: codex

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# SonarQube AI Slop Gate

The decisions self-hosted SonarQube forces when you use it to gate AI-generated code, and how to settle them. Every rule names the wrong default it corrects; there is no rule for what the model already gets right.

**Pinned to a date, not a version.** SonarQube ships a release every two months, so every claim here was verified against docs.sonarsource.com in **July 2026**, against **SonarQube Server 2026.3** (current LTA **2026.1**). 2026.4 had shipped at the time of writing but the documentation still defaulted to 2026.3, so that is what these rules describe — `plat-versions-are-calendar-based` covers the release train itself. Re-verify anything version-shaped before trusting it, and read docs from the **unversioned** path (`/latest/<page>` does not resolve); appending `.md` to any docs URL returns its markdown source.

**The failure this skill exists to prevent** is a gate that passes everything. A SonarQube setup assembled from 2024-vintage knowledge will analyze the wrong branch, upload to the wrong server, exit green on a red gate, and skip the duplication and coverage conditions entirely on the small commits that AI-assisted work produces most of. None of those failures announce themselves; the dashboard looks healthy throughout.

## When to Apply

Use this skill when:

- Standing up self-hosted SonarQube Server, or reviewing an existing instance, with the goal of catching AI-generated defects continuously rather than reporting on them after the fact
- Designing or tightening a quality gate — especially deciding what to measure on new code versus overall code, and discovering which conditions are silently not evaluated