Hello everyone!
Thanks to all who attended our session today for North America and EMEA! Find below the questions that were asked during our webinar:
Q: Is Sonarlint okay to use when working with confidential data/code?
A: Yes, SonarLint would work even in air gapped environment (without WAN or LAN access). It uses some telemetry, which can be disabled. The same can be said of SonarQube.
Q: Does Sonar Lint send any code to Sonar servers?
A: It can run standalone, connect to your private SonarQube server, or connect to a SonarCloud account. Both SonarLint and SonarQube run in environments you control and do not send any of your code to Sonar for analysis. You run the Sonar analyzers in your environment to analyze your code all managed by you.
Q: How frequently ruleset for IaC scanning is updated? What is the size of the rule set for terraform IaC, is it part of SonarQube?
A: It depends, I would say they are updated every quarter. The ruleset for Terraform can be reviewed here: SonarQube. If you have ideas or suggestions, feel free to reach out to our Community!
Q: GitHub copilot is free to use?
A: No, GitHub Copilot is currently $10/mo for personal use.
Q: Has an AI tool been used to generate a state diagram versus directly coding a solution?
A: It seems possible to use Gen AI to generate code describing a UML diagram, like mermaid for markdown.
Q: Are there pre-built quality profiles out of the box or do you have to define your custom ones?
A: We provide our recommended quality profile for best practices out of the box called the “Sonar way”. More information is available here (on our default built-in quality profiles and how to define custom ones): Quality profiles
Q: Can your solution be installed on an internal organizational intranet i.e no connection to the internet? Our code is controlled for security reasons.
A: Yes it can, and it is a common use case for many security-sensitive industries (finance; defense) using our solutions.
Q: Couldn’t be SonarLint an automatic step after the generation of the code? So you don’t need to check all typical errors manually.
A: On-the-fly analysis is available on certain IDEs for SonarLint. So if the generated code is directly injected into a file, SonarLint will review it automatically.
Q: Is SonarLint useable if you use Resharper?
A: It is possible to define the set of rules that are used by SonarLint so that it would not overlap with those of Resharper.
Q: If we install SonarLint is it enough to use AI features?
A: SonarLint is not a Gen AI tool but can be used to check whether generated code meets quality and security standards.
Q: SonarQube doesn’t get you the GenAI features, does it?
A: No, but scanning code with SonarQube is recommended anytime you use AI code generation tools. It helps make the use of Gen AI safer.
Q: Can I connect SonarLint with SonarCloud? Or is this functionality only in SonarQube?
A: Yes Sonarlint is compatible with SonarCloud as well as SonarQube
Q: When SonarLint is installed on Visual Studio, how can we see the CoPilot window?
A: SonarLint is independently developed, and can work without GitHub Copilot (Installation - Visual Studio). To install Copilot, you can browse the Visual Studio marketplace.
Q: Can SonarCloud be used with private GitLab repositories for free - for educational purposes?
A: On a case-to-case basis, we may consider giving away some keys or licenses to use (either for open-source projects or educational institutions). I would suggest you to contact us and describe your need: Contact | Sonar SonarSource
Q: Can this also help with compliance challenges (reporting on usage of GenAI for coding)? About controls for SOC 2 Type II and ISO 27001. Auditors are looking for some reporting on usage of GenAI in code.
A: The use of code quality and security tools in general might help with gaining access and/or maintaining access to ISO 27001 and SOC 2 Type II.
Q: What’s the process to add new rules in a customized quality profile, is it possible in Community Edition?
A: Yes, it is possible, even on the Community Edition, please review the documentation Quality profiles
Q: Did you try to estimate the improvements of productivity/velocity w.r.t. some metrics?
If so, which metrics did you use? What are your results?
A: In order to illustrate the benefits of correcting issues as early as possible in the software development lifecycle, we don’t measure metrics ourselves, but instead we rely on some known studies and research, such as this one.
