Tools/SonarQube
SonarQube
Static code-quality scanner — bugs, code smells, duplication, and maintainability/coverage metrics with a "quality gate" that can block a PR/pipeline merge. Complements rather than overlaps Snyk: SonarQube grades code quality/maintainability, Snyk grades security vulnerabilities (SAST/SCA). Typically wired into GitHub_Actions as a required check.