> Markdown version of [/videos/428-automated-code-quality-checks-with-custom-sonarqube-rules?t=381](https://www.wearedevelopers.com/videos/428-automated-code-quality-checks-with-custom-sonarqube-rules?t=381). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Automated Code Quality Checks with Custom SonarQube Rules

Stop relying on passive documentation to enforce enterprise code quality. Convert your internal guidelines into custom SonarQube plugins to block non-compliant pull requests from ever merging.

- **Speakers:** Daniel Strmečki, Martin Gluhak
- **Event:** World Congress 2022
- **Published:** June 15, 2022
- **Duration:** 48:29
- **URL:** https://www.wearedevelopers.com/videos/428-automated-code-quality-checks-with-custom-sonarqube-rules

## Summary

Ensuring high code quality across large-scale enterprise projects requires moving beyond passive documentation toward automated enforcement. A sustainable approach rests on the philosophy that development inherently represents testing and coding combined, making rigorous structural standards a comprehensive team responsibility. Recalling the principle that "any fool can write code that a computer can understand," the modern development challenge is structuring logic logically so that fluid engineering teams can reliably maintain complex systems. However, while establishing documented coding guidelines provides a critical baseline, these standards rarely shift daily behavior unless they are strictly enforced through pull request decoration that reliably blocks non-compliant code from merging.

Standard code analysis tools effectively flag generic syntax issues but often ignore specific architectural boundaries and proprietary enterprise frameworks. To enforce macro-level design integrity, engineering teams can implement ArchUnit to validate layer isolation, architectural dependencies, and naming conventions within familiar unit testing paradigms. For code-level compliance beyond default configurations, converting internal team guidelines into custom SonarQube plugins bridges the gap between institutional knowledge and reliably executed continuous integration workflows.

Authoring these custom static analysis rules follows a highly accessible, test-driven approach using automated templates. Engineers parse the raw code through abstract syntax trees to flag improper execution—such as identifying a deprecated return type via a standard visitor pattern—and assert functionality against dummy non-compliant snippets. Ultimately, distributing these internally engineered plugins through a centralized server and syncing them locally via SonarLint delivers immediate, context-rich error feedback straight to the developer's IDE, dramatically minimizing organizational friction and aligning code bases naturally.

**Keywords:** custom sonarqube rules, static code analysis, archunit framework, sonarlint integration, pull request decoration, automated quality gates, java abstract syntax tree, test-driven rule development, enterprise architecture compliance, clean architecture validation, continuous code inspection, semantic code analysis, automated coding guidelines, java code coverage

## Chapters

1. **Setting the context for code quality and custom rules** (00:11) — An overview of utilizing automated code checks to differentiate products and attract developer talent.
1. **Reasons for establishing code standardization and routine checks** (03:02) — Standardization builds customer trust, prevents repeated errors across projects, and simplifies new joiner onboarding.
1. **Establishing a company-wide approach to software quality assurance** (06:21) — Quality becomes the entire team's responsibility when testing is heavily automated and integrated into continuous development.
1. **Test automation strategy and following the testing pyramid** (08:24) — Most automated testing is handled at the unit level, preserving manual testing for edge cases and exploratory scenarios.
1. **Documenting and sharing standard software coding guidelines centrally** (11:20) — Relying strictly on basic static analysis is insufficient without aligned developer habits and detailed organizational documentation.
1. **Enforcing quality standards strictly with pull request decoration** (16:43) — Blocking a pull request merge upon a failed branch analysis ensures developers comply with centralized code metrics.
1. **Validating Java application architecture design with automated tests** (17:41) — The ArchUnit library natively uncovers cyclic dependencies and package naming violations within a standard test suite.
1. **Translating custom guidelines into automated static analysis checks** (19:03) — Automating organizational rules into specific SonarQube checks captures framework quirks that out-of-the-box analysis natively ignores.
1. **Creating a boilerplate project for custom rule development** (20:57) — The open-source Sonar Java plugin repository provides a straightforward maven template for bootstrapping customized static analysis rules.
1. **Writing test-driven unit tests for custom rule validation** (24:53) — Analyzing mocked non-compliant code snippets confirms whether a custom rule successfully catches targeted programming violations.
1. **Implementing syntax tree visitor logic for code rules** (29:21) — A custom visitor method inspects a method's return type token to detect and flag restricted class usages.
1. **Adding metadata and documentation to new custom rules** (34:52) — Providing JSON and HTML resources displays rule severity, expected compliance times, and alternative solutions natively within SonarQube.
1. **Building and installing the compiled custom rule extension** (38:38) — A standard maven build generates a jar executable that smoothly activates when copied directly into the SonarQube extensions directory.
1. **Synchronizing local developer tools with centralized custom rules** (42:02) — Linking the SonarLint IDE plugin to a customized SonarQube instance automatically distributes organizational guidelines to all developers.
1. **Audience questions on rule documentation and workflow updates** (45:41) — Custom checks require comprehensive maintenance processes to safely track updates and manage deployment into the centralized marketplace.

## Related Moments

- [Enforcing code quality rules across client projects](https://www.wearedevelopers.com/videos/100345-code-once-use-everywhere-building-shared-libraries-for-multiple-projects) (from "Code Once, Use Everywhere: Building Shared Libraries for Multiple Projects")
- [Enforcing consistent code quality with static analysis](https://www.wearedevelopers.com/videos/1723-wearedevelopers-live-graalvm-in-action-static-analysis-insights-and-more) (from "WeAreDevelopers LIVE - GraalVM in action, Static Analysis insights and more")
- [Evaluating generated code syntax and maintaining quality control](https://www.wearedevelopers.com/videos/1906-rag-s-not-dead-you-re-just-using-it-wrong-phil-nash) (from "RAG's Not Dead, You're Just Using It Wrong! - Phil Nash")
- [Applying customizable rules for static code analysis](https://www.wearedevelopers.com/videos/959-supercharging-static-code-analysis-konveyor-ai-llms) (from "Supercharging Static Code Analysis: Konveyor AI & LLMs")
- [Enforcing coding standards with editor configurations and analyzers](https://www.wearedevelopers.com/videos/1556-what-you-can-learn-from-an-open-source-project-with-500-million-downloads) (from "What you can learn from an open-source project with 500 million downloads")
- [Modifying methodology rules for organizational specific needs](https://www.wearedevelopers.com/videos/1588-shaping-up-rethinking-product-development-with-basecamp-s-shape-up-methodology) (from "Shaping Up: Rethinking Product Development with Basecamp's Shape Up Methodology")

## Related Articles

- [The real reason we document our code](https://www.wearedevelopers.com/magazine/518-the-real-reason-we-document-our-code)
- [Liuba Gonta and Yuliya Khadasevic - GitHub Copilot Beyond the Basics - 10 Ways to Elevate Your Coding](https://www.wearedevelopers.com/magazine/490-liuba-gonta-and-yuliya-khadasevic-github-copilot-beyond-the-basics-10-ways-to-elevate-your-coding)
- [How to Avoid Over-Engineering](https://www.wearedevelopers.com/magazine/546-how-to-avoid-over-engineering)
- [Code reviews might actually be pointless](https://www.wearedevelopers.com/magazine/519-code-reviews-might-actually-be-pointless)

## Related Jobs

- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Tribe Lead - ( Software) Engineering Centre of Excllence](https://www.wearedevelopers.com/jobs/ext/1475530-tribe-lead-software-engineering-centre-of-excllence) at **SD Worx**
- [Senior Software Engineer, Enterprise Products](https://www.wearedevelopers.com/jobs/ext/1841248-senior-software-engineer-enterprise-products) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Senior Software Engineer, Client Apps Platform](https://www.wearedevelopers.com/jobs/ext/1773893-senior-software-engineer-client-apps-platform) at **GitHub**
- [Machine Learning Engineer](https://www.wearedevelopers.com/jobs/ext/1597388-machine-learning-engineer) at **ZEISS Group**