Imagine: you release a mobile app update, but a NullPointerException that slipped through code review goes into production. Or you don't notice duplicate logic in two modules, and a month later fixes take twice as long. Manual checks and linters don't give a unified picture, especially in large projects with dozens of modules. Regressions pile up, technical debt grows, and development speed drops. We integrate SonarQube — a centralized static analyzer that automatically controls the quality of every commit and prevents defects from reaching the main branch.
Why a Mobile Project Needs SonarQube
SonarQube works with Swift, Kotlin, Java, TypeScript, and Dart. For a mobile app, this means: finding potential NPEs before production, controlling duplication across modules, tracking code smells in coroutines, and enforcing a coverage threshold before merge. We've seen projects where after implementation the number of bugs dropped by 40% in six months — that's not only stability but also savings: the team spends 30% less time on regression testing. Our certified engineers set up SonarQube for your project in 1–3 days. We guarantee that code quality will improve 2–3 times compared to manual review.
Why Integrate SonarQube in CI?
Without automated analysis, every code change carries risk. Humans miss small defects that accumulate. SonarQube in CI catches them immediately: after every push, analysis runs, and if the Quality Gate fails, the build breaks. This disciplines the team and reduces code review time. For example, a typical review takes 30 minutes per PR, while SonarQube checks the entire project in 2–3 minutes. Over a month, a team of five developers saves up to 20 person-hours — a resource that can be directed to new features.
How to Set Up SonarQube for Android
The SonarQube plugin integrates into Gradle:
// build.gradle.kts (project level) plugins { id("org.sonarqube") version "4.4.1.3373" } sonar { properties { property("sonar.projectKey", "myapp-android") property("sonar.host.url", System.getenv("SONAR_HOST_URL") ?: "http://sonarqube:9000") property("sonar.token", System.getenv("SONAR_TOKEN") ?: "") property("sonar.sources", "app/src/main/kotlin") property("sonar.tests", "app/src/test/kotlin,app/src/androidTest/kotlin") property("sonar.android.lint.report", "app/build/reports/lint-results-debug.xml") property("sonar.coverage.jacoco.xmlReportPaths", "app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml") property("sonar.kotlin.detekt.reportPaths", "app/build/reports/detekt/detekt.xml") } } Run analysis in CI:
./gradlew \ lintDebug \ testDebugUnitTest \ jacocoTestReport \ detekt \ sonar \ --info JaCoCo is configured separately to generate an XML coverage report. For Kotlin we use detekt, which catches code smells related to coroutines and architecture.
How to Set Up SonarQube for iOS
SonarQube analyzes Swift via the sonar-scanner CLI with the sonar-swift plugin or the built-in Swift analyzer (SonarQube 10+):
# sonar-project.properties sonar.projectKey=myapp-ios sonar.sources=MyApp/Sources sonar.exclusions=**/*.generated.swift,Pods/**/* sonar.swift.coverage.reportPaths=fastlane/test_output/coverage.xml sonar.swift.swiftlint.reportPaths=fastlane/swiftlint-report.json In CI:
# Generate coverage xcodebuild test \ -scheme MyApp \ -destination 'platform=iOS Simulator,name=iPhone 15' \ -enableCodeCoverage YES # Convert to format SonarQube understands slather coverage \ --cobertura-xml \ --output-directory fastlane/test_output \ MyApp.xcodeproj # Analyze sonar-scanner \ -Dsonar.token=$SONAR_TOKEN \ -Dsonar.host.url=$SONAR_HOST_URL For iOS we use slather to convert coverage to Cobertura XML — the format SonarQube understands. And swiftlint catches stylistic issues and potential errors.
How to Set Up Quality Gate in PR
A Quality Gate is a set of conditions that, if not met, cause SonarQube to block the merge. Typical thresholds for a mobile project:
| Metric | Condition |
|---|---|
| Coverage on new code | >= 70% |
| Duplications on new code | <= 5% |
| Maintainability Rating | A |
| Reliability Rating | A |
| Security Rating | A |
| Security Hotspots Reviewed | 100% |
In GitHub Actions, integration via sonarqube-quality-gate-action:
- name: SonarQube Quality Gate check uses: sonarsource/[email protected] timeout-minutes: 5 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} If the Quality Gate fails, CI breaks and the PR cannot be merged. For GitLab CI, a similar configuration via sonar-scanner.
SonarCloud or Self-Hosted: Which to Choose?
| Criterion | SonarCloud | Self-hosted SonarQube |
|---|---|---|
| Infrastructure | Not required | Server (minimum 2GB RAM) |
| Price | Free for open source | Community Edition free, Developer Edition paid |
| Data control | Cloud | Full |
| Setup time | 1–2 hours | 1–2 days |
| Feature branch analysis | Yes (all plans) | Only Developer Edition |
SonarCloud is faster to implement, self-hosted gives full control. For most commercial projects, we recommend SonarCloud — setup time is halved. If you need to store code in a closed environment, choose self-hosted.
What’s Included
- Deploying SonarQube (cloud or self-hosted)
- Creating a project and configuring plugins (Gradle, sonar-swift)
- Integrating coverage (JaCoCo, slather) and linters (detekt, swiftlint)
- Adding analysis step to CI
- Customizing the Quality Gate for your stack
- Documentation and team training
- Technical support during the implementation phase
Our engineers hold SonarQube certifications and have 5+ years of experience in mobile development. We have successfully implemented analysis for more than 50 projects, including apps with millions of users. Contact us for a consultation — we will prepare a configuration for your project and train your team. Order SonarQube implementation and get stable code quality.
Timeline and Cost
Setup takes 1–3 days depending on project complexity. Cost is calculated individually. Reach out to us — we will evaluate your project and offer the optimal solution.