Better together: Gitar and SonarQube

Time to complete icon5 minutes to complete

Overview

This course explains why SonarQube's rule-based analysis and Gitar's context-aware review work together as complementary layers of code verification, rather than one replacing the other. Through a worked example, it shows how Gitar catches intent-based flaws that pass SonarQube's checks, then drafts and verifies a fix — closing the loop from detection to a merge-ready solution.

Learning objectives

After completing this course, you’ll be able to:

  • Describe the multi-layer verification model.
  • Define how SonarQube and Gitar work together.
  • Position Gitar as an additional layer of code security, not a replacement.

Key topics

  • SonarQube's deterministic and Gitar's non-deterministic analysis
  • Multi-layer verification
  • PR/MR workflows

Target audience

  • Administrators
  • Analysts
  • Developers
  • DevOps engineers
  • Engineering leaders
  • Stakeholders

Prerequisites

  • Familiarity with Git (commits, branches, diffs) and the PR/MR workflow
  • Familiarity with the PR/MR workflow on your code host (GitHub, GitLab, or similar)