FreePublished on GitHub

sonarqube-maintainability-gate

Run SonarQube/SonarCloud against production code to surface Code Smells, Bugs, and Maintainability ratings - the maintainability lens rather than the security lens. Production-only scope via sonar.exclusions; test code is reviewed separately. Use when a team wants maintainability and technical-debt ratings gating PRs, or when an existing SonarQube project reports numbers nobody has tied to a quality gate.

The English summary is being prepared. Showing the original description.

testland/qa13 stars(GitHub 13 + cccskills 0)

Run score Not tested

See how to install

Files included (2)

SKILL.md5.3 KB
.tessl-plugin/plugin.json554 B

SKILL.md (original)

Review the instructions the agent will receive before you install.

sonarqube-maintainability-gate

SonarQube classifies issues across three software qualities - Reliability, Maintainability, Security - and four Clean Code attributes (Consistent, Intentional, Adaptable, Responsible) per the SonarSource docs (see Issues introduction). qa-security-scanning's sonarqube-rules skill covers the Security lens; this skill covers the Reliability + Maintainability lens for production code.

When to use

A pull request touches production code and you want Bug/Code-Smell metrics scoped to the diff (not test files).
Pre-merge Quality Gate enforcement on the Sonar Way default (no new issues; new-code coverage ≥80%; new-code duplication ≤3% - per Sonar Way QG).
Legacy codebase entering Sonar adoption - focus on new code only to avoid baseline-debt theater.

Step 1 - Install scanner

Stack	Scanner
Maven	`sonar-maven-plugin` (`mvn sonar:sonar`)
Gradle	`org.sonarqube` plugin (`./gradlew sonar`)
.NET	`dotnet-sonarscanner`
Anything else	`sonar-scanner` CLI

See the SonarQube docs sitemap for per-build-tool installation.

Step 2 - Scope to production code

Add to sonar-project.properties:

sonar.projectKey=acme.platform
sonar.sources=src
sonar.tests=tests,src/**/*.test.ts
sonar.exclusions=**/*.generated.*,**/migrations/**,**/vendor/**
sonar.test.inclusions=**/*.test.ts,**/*.spec.ts,tests/**
sonar.coverage.exclusions=**/*.generated.*,**/main.ts

Why separate sonar.tests vs sonar.sources: test code has different quality expectations (long names, deliberate duplication for clarity, Arrange-Act-Assert patterns). Lumping them into one scope produces noise. Test code is reviewed separately.

Step 3 - Run scan

# Local development scan against a SonarQube server
sonar-scanner \
  -Dsonar.host.url=https://sonar.internal \
  -Dsonar.token=$SONAR_TOKEN

# CI scan with PR analysis (branch + PR decoration)
sonar-scanner \
  -Dsonar.pullrequest.key=$PR_NUMBER \
  -Dsonar.pullrequest.branch=$PR_BRANCH \
  -Dsonar.pullrequest.base=main

The scanner uploads to the configured server; results stream to the project dashboard.

Step 4 - Read the dashboard

Metric	What it means	Sonar Way default
New Bugs	Reliability issues introduced in PR	0
New Code Smells	Maintainability issues introduced in PR	0
New Coverage	% new lines covered by tests	≥ 80%
New Duplication	% new lines duplicated	≤ 3%
Maintainability Rating (new code)	A - E based on debt ratio	A
Reliability Rating (new code)	A - E based on bug density	A

Per Sonar Way QG: any condition fail blocks merge.

Step 5 - Quality Gate as CI gate

# GitHub Actions
- name: SonarQube Scan
  uses: SonarSource/sonarqube-scan-action@v3
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: SonarQube Quality Gate Check
  uses: SonarSource/sonarqube-quality-gate-action@v1
  timeout-minutes: 5
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

The quality-gate-action polls the server until the gate result lands and fails the build if it's RED.

Anti-patterns

Anti-pattern	Why it fails	Fix
Scan whole repo without `sonar.tests` separation	Test conventions flagged as smells; team disables Sonar	Split `sonar.sources` / `sonar.tests` (Step 2)
Apply gate to overall code, not new code	Legacy debt blocks all PRs forever	Use new-code-period gate (Sonar Way default)
Mix this with the `sonarqube-rules` security settings	Two skills mutating same `sonar-project.properties`	This skill owns Reliability+Maintainability; `sonarqube-rules` owns the Security profile
Lower gate to merge pre-existing failures	Gate becomes meaningless	Use "Wont Fix" / "Accepted" issue resolution + scope-exclusion comment instead
Run after merge only	No PR decoration; hard to review	Run on PR with `sonar.pullrequest.*` flags (Step 3)

Limitations

Sonar Way thresholds are tuned for greenfield + healthy codebases. Brownfield rollout: keep gate but mark all pre-existing as "Accepted" with re-review date + waiver template (Reason: + Approved-by: + Re-review-date: + expires:).
Self-hosted SonarQube (Community) does not include MQR severity granularity; SonarCloud + Enterprise do.

References

Issues introduction - Clean Code attributes, software qualities, Sonar Way Quality Gate defaults
SonarQube docs sitemap - per-build-tool scanner setup, current config options

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

a11y-violation-gate

Free

Builds a CI gate that fails the build on **new** WCAG / a11y violations introduced by a PR while grandfathering pre-existing violations on a per-rule / per-page baseline. Aggregates verdicts from axe-core / pa11y / Lighthouse a11y / WAVE / IBM Equal Access scans. Use when a project has accumulated a11y debt and a strict "zero violations" gate would block every PR - the ratchet pattern lets the team ship while preventing regressions.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

ab-test-validity-checklist

Free

Workflow skill that builds an A/B-test validity checklist from an experiment proposal, walking the canonical design-correctness gates - pre-registered OEC/power/guardrails, randomization unit + SRM check, assignment integrity, telemetry, peeking discipline, novelty/primacy, post-experiment SRM re-check - into a per-experiment checklist + sign-off form. Use when launching, auditing, or governing an experiment. For pitfall mechanics (guardrails, peeking) see experiment-results-interpreter's references; to read an already-valid result use experiment-results-interpreter; for per-SDK harness tests use experiment-sdk-testing - this gates DESIGN, not SDK code.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

add-to-homescreen-flow-tests

Free

The single install-flow skill: the reference contract for the PWA install flow (installability gate fields, `beforeinstallprompt` handshake, per-platform paths - Android WebAPK / iOS Share menu / Firefox no-op - and the `display-mode` post-install signal, in references/install-flow-reference.md) plus the build-an-X workflow that emits the Add-to-Home-Screen suite. Walks the four-stage timeline, emitting one test per gate cell per [web.dev/articles/install-criteria][install-criteria], the deferred-prompt → `prompt()` → `userChoice` chain per [web.dev/articles/customize-install][customize-install], the iOS Safari manual-metadata branch (`apple-touch-icon`) per [web.dev/learn/pwa/installation][learn-pwa], and the post-install `(display-mode: standalone)` MQ assertion. Output: a Playwright spec with per-stage cells plus a coverage matrix. Use when a PWA's manifest, icons, or install handler change, when install conversion drops at an unknown stage, or when triaging a flaky install assertion.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

ai-spec-coverage-mapper

Free

Build-an-X workflow that uses an LLM to map existing tests to spec sections - given a spec doc + the test suite, the LLM identifies which tests cover which sections, surfaces uncovered sections (gap), and recommends specific tests to add. Output is a coverage matrix per spec ID. Scope is mapping tests that already exist and naming the gaps, not authoring tests for new acceptance criteria. Use when a spec doc and a test suite both exist but nobody can say which requirements are actually covered - before a release sign-off, an audit, or a decision about where to spend the next round of test effort.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

ai-test-generator

Free

Generates tests from natural-language specs (acceptance criteria, user stories, requirements) using an LLM, with confidence scoring per test case (LLM self-assessment plus heuristics: assertion quality, naming, completeness), batching uncertain cases for human review, and integration with the team's existing test framework. Use when the user asks to generate unit tests from acceptance criteria, convert user stories to test cases, automate test creation from requirements, or augment a spec-driven test suite with AI-generated stubs that are then curated before merge.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

allure-reports

Free

Configures Allure Report (test-runner adapter install, `allure-results` directory wiring, `categories.json` for failure classification, `history-trend.json` retention via the copy-history-between-runs pattern), runs the Allure CLI to convert `allure-results` to a static HTML site, and uploads the report as a CI artifact. Use when the team needs richer test reporting than JUnit XML - step-level attachments, per-test history, retry tracking, and severity / epic / feature labeling across framework-agnostic adapters (pytest, Jest, JUnit, TestNG, NUnit, Mocha). As a rich static HTML report generator, it is the open-source alternative to the sunset ExtentReports (JVM/.NET per-test HTML narrative); for hosted cross-run flakiness analytics rather than a static per-run report use currents-integration.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

See all skills by testland

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/testland/qa --skill sonarqube-maintainability-gate

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/testland/qa/tree/main/plugins/qa-code-quality/skills/sonarqube-maintainability-gate

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/sonarqube-maintainability-gate/ for Claude Code, or ~/.agents/skills/sonarqube-maintainability-gate/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: testland/qa
Stars: 13
Forks: 3
Category: Testing & Security
License: MIT
Original language: English
Last updated: Oct 20, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.