Is it possible to use CodeQL to replace code quality tools like SonarQube or Codacy?

[phillips-tech]

CodeQL is specifically geared toward security analysis, but it seems that the tool should be able to do things like detecting "code smells" like SonarQube. Do any sufficient query packs like this exist? A corollary - where can one find published CodeQL query packs other than those provided by GitHub?

[carogalvin]

@phillips-tech

👋 PM with the code scanning team at GitHub here. Are you using our GitHub Advanced 安全 suite of tools or CodeQL independently today? We're starting explorations into the area of code quality and would be interested in speaking with you more about your needs here. If you're interested, please feel free to grab a spot on my calendar here: https://calendar.app.google/1wcXpbxvSVYYzmCi8

[carogalvin]

@matt-buchanan yes! The link I posted above for my calendar is still active (next week I'm out at Black Hat so availability may be limited until the week of the 11th).

[jjkcharles]

Hi Caro, glad to know Code quality is being considered and explored as part of CodeQL.

Has there been any updates since the original post, that you'll be able to share?

I am exploring tools for Code Quality/安全 Scan for my org. and have been wondering if CodeQL is a good alternative for tools like Sonar, but haven't had much success so far.

[carogalvin]

@jjkcharles we are still working on this, currently in a private preview stage. I'd love to hear more about your code quality needs at your org, feel free to book some time with me: https://calendar.app.google/qBKmsgLHjDQfiQNx8

Or send me an email (my handle @github.com)

[romanglogowski-volue]

Hello,
We're considering usage of CodeQL as replacement for SonarCube.
Can you share any additional information about CodeQL capabilities in this area?

[carogalvin]

@romanglogowski-volue our product is currently free in public preview and we are constantly adding new features - check it out by enabling it on a repository via the repository settings page!