SonarQube CLI 1.8 — Actionable Quality Gate drill-downs and smoother agents integrations

Sonar Updates
, , , ,
1

Dear community,

We’re excited to announce SonarQube CLI v1.8.0, a release that makes Quality Gate failures actionable at a glance, adds manual project binding command, and delivers quality-of-life improvements across issue listing, authentication, and agentic integrations.

What’s new

Drill down into failing Quality Gate conditions

sonar quality-gate status now supports --category <coverage|duplications|issues|security|dependency-risks> and --top <N> to surface the worst-N files or issues behind each failing condition.

  • Coverage: shows the files with the lowest coverage for failing coverage conditions.

  • Duplications: shows the files with the highest duplication metric for failing duplication conditions.

  • Issues, Reliability, and Maintainability: shows the highest bugs, code smells, and violations for failing issue-count and rating conditions.

  • Security: shows the highest vulnerabilities for failing security conditions.

  • Dependency Risks: shows the worst SCA dependency risks, including malware, prohibited licenses, and vulnerabilities, for failing SCA conditions.

sonar quality-gate status <file> can now narrow the Quality Gate view to a single file or directory, showing only relevant conditions and issues. Add --all to include passing conditions.

When neither --branch nor --pull-request is provided, the command now automatically resolves the pull request for the current branch through the SonarQube API.

More focused issue listing

sonar list issues now accepts --file <path> to scope results to a specific file or directory without going through the Quality Gate. It also returns only open and confirmed issues by default, matching the most common workflow.

Agentic integrations brings Vortex to all SonarQube analyzed projects in one command

  • When no project is linked, sonar analyze agentic (Vortex) integration no longer emits a distracting skip message on every agent end of turn; agents are instructed to discard the output silently.

  • Vortex (Agentic Analysis) now works for global-scope integrations. sonar integrate claude -g, and other global integrations, install Vortex analysis hooks without a project directory; project resolution happens at runtime.

  • Vortex context is now delivered through the agent session-start hook instead of a static SKILL.md file, removing the project-scope constraint and preventing stale files from prior installs.

Manual project binding

The new sonar link <project-key> command writes a local binding file for the current directory. Use it to associate a repository with a SonarQube project key when automatic discovery cannot find one.

Improved authentication

  • sonar auth login now warns when authentication environment variables are already set, explains that they take precedence, and directs you to sonar auth status to inspect the current connection.

You can find more information about this release here.

Run the sonar update command to get the latest SonarQube CLI version and enjoy these new capabilities!

Happy coding,
Farah.

Sonar Community Roundup, Sept 12 - 18