Qualor: open-source SonarQube alternative with no lines-of-code licence

Condition	Value	Threshold	Status
`new_issues`	2	> 0	failed
`new_coverage`	71.4	< 80	failed

One line in your pipeline.

The scanner runs in CI, collects results from every analyzer as SARIF, works out which lines the merge request changed, and sends one compact report to your server. It waits for the verdict and fails the job when the gate fails.

On GitLab, findings also show in the merge request widget and the security tab through the Code Quality and SAST reports. The CI/CD component is in the GitLab CI/CD catalog.

include:
  - component: gitlab.com/qualor/qualor/qualor@1
    inputs: { image-tag: "1" }

qualor:
  # forks get no secrets, so their pull requests are skipped
  if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
  runs-on: ubuntu-latest
  container: { image: qualor/scanner:1, options: --user 1001 }
  steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
        persist-credentials: false
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
    - run: qualor scan
      env:
        QUALOR_URL: ${{ vars.QUALOR_URL }}
        QUALOR_TOKEN: ${{ secrets.QUALOR_TOKEN }}

What Qualor does

It judges only the code you changed

Old issues stay visible, but they never block a merge. The gate looks at new code: new issues, coverage of new lines, duplication in new lines. Small changes don't fail on coverage percentages.

Your analyzers, one list

No rule engine of our own. Qualor runs proven open-source tools and merges what they find. The same finding from two tools shows once.

ESLintTypeScript, JavaScript
PMDJava
SpotBugsJava bytecode
OpenGrepSecurity patterns, 30+ languages
GitleaksCommitted secrets
TrivyVulnerable dependencies
Your SARIFAny tool, --sarif

Issues that survive a refactor

Each issue gets a fingerprint from its rule, file and surrounding code, not its line number. Move the code and the issue keeps its history and its status.

It answers where you review

A summary comment and a status per project on GitLab merge requests and GitHub pull requests, with new issues marked on the lines that caused them: inline discussions on GitLab, check-run annotations on GitHub. Fix an issue, or mark it a false positive, and its mark goes away.

Coverage, duplication, complexity

Imports LCOV, Cobertura and JaCoCo. Measures cognitive complexity with tree-sitter and finds copy-pasted code. Keeps the history of every branch and merge request.

Coverage86.2%Better than 64.0%
Duplication1.8%Better than 4.1%
Complexity6.3Better than 9.8

Triage unblocks the merge

Mark a finding as a false positive or won't fix, and the gate is judged again at once. No new pipeline needed.

Mediumsrc/invoices/csv.ts:41Cognitive complexity 21 is over 15

OpenFalse positiveWon't fix

Quality gateFailed: new_issues 1 > 0Passed, judged again, no pipeline

An assistant that runs on your terms.

Ask Qualor to explain an issue, to judge whether a finding is a false positive, or to suggest a fix and post it to the merge request. You bring the model: any OpenAI-compatible endpoint, Anthropic, or a local model through Ollama or vLLM.

Off until you configure a provider.
Your key, your model, your network.
Every suggestion is a proposal in the review, never a silent commit.

Suggested fixsrc/invoices/export.ts:88

The query is built from req.query.status. Pass it as a parameter instead.

- db.query(`SELECT * FROM invoices WHERE status = '$${status}'`)
+ db.query("SELECT * FROM invoices WHERE status = $1", [status])

Model: local, llama via OllamaApply suggestion

Scattered dots gathered by fine lines into one clean circle

Leave SonarQube in one command.

Point Qualor at your SonarQube server. It brings over your quality profiles, your quality gates and the status of every issue, so the false positives and won't-fix decisions your team already made stay made.

qualor import sonarqube \
  --url https://sonar.example.com \
  --token $SONAR_TOKEN

How Qualor compares with SonarQube

Analyse ten million lines. Pay nothing for them.

The community edition is MIT licensed with no limit on lines of code, users or projects. When the organisation needs single sign-on, provisioning, roles and an audit trail, the enterprise edition adds them to the same server.

Lines of code you analyse

1.2 millionLicence cost for those lines: 0

A tape measure unrolling across the page without end

Community

Free, MIT licence

Everything on this page. Unlimited lines of code, users and projects, up to three organisations.

Get started

Enterprise

Commercial licence, never priced by lines of code

SSO, SCIM, roles, audit log, portfolio reports, compliance exports and priority support.

Contact sales See Enterprise

Running in minutes

The server is one container plus PostgreSQL 16. Use Docker Compose on a single machine, or the Helm chart on Kubernetes.

Start the server

git clone https://github.com/qualor-dev/qualor.git && cd qualor
cp deploy/.env.example deploy/.env    # set the three secrets
docker compose -f deploy/docker-compose.yml up -d

Create a project and a token
Sign in as admin, create a project, then an access token with the Upload analyses scope.
Add the scanner to CI
Set QUALOR_URL and QUALOR_TOKEN as CI variables and add the snippet above. For review comments, connect GitLab, or create a GitHub App, add it in Settings and install it on the repository.

A single server drawn in outline, with lines passing through it

Questions

Is Qualor free?

Yes. The community edition is MIT licensed, with no limit on lines of code, users or projects. The only cap is three organisations per server. SSO, SCIM, roles, the audit log and portfolio reports are in the enterprise edition.

Can Qualor replace SonarQube?

For what most teams use SonarQube for, yes: issues, coverage, duplication, complexity, quality gates on new code, and merge request decoration. Qualor has no rule engine of its own; it runs proven open-source analyzers and unifies their results. It does not aim for rule-by-rule parity.

Which languages does it support?

Whatever its analyzers cover: TypeScript and JavaScript with ESLint, Java with PMD and SpotBugs, more than 30 languages through OpenGrep security rules, secrets in any file with Gitleaks, and dependencies with Trivy. Any other tool that writes SARIF plugs in with --sarif.

Does my code leave my network?

No. Qualor has no telemetry and makes no calls except to your Qualor server and your GitLab or GitHub. The LLM assistant is off until you configure it, and it can run on a local model through Ollama or vLLM.

How do I move from SonarQube?

Run qualor import sonarqube with your SonarQube URL and a token. It brings over quality profiles, quality gates and issue statuses, so false positives and won't-fix decisions stay made.

Does it work with GitHub?

Yes. GitLab is supported through merge request comments, inline discussions, commit statuses and GitLab's Code Quality and SAST reports. GitHub.com and GitHub Enterprise Server are supported through a GitHub App you create and install: a check run per project with annotations on the changed lines, and one summary comment on the pull request, edited in place. The check run's Re-run button asks Qualor to post again.

How do I run it?

The server is one container plus PostgreSQL 16. Use the Docker Compose file for a single machine or the Helm chart for Kubernetes. The scanner is one container image, or a single static binary, in your CI.