Qualor documentation

Qualor is an open-source, self-hosted code quality platform. It is an alternative to SonarQube with no lines-of-code licence. It runs open-source analyzers you already know: ESLint, PMD, SpotBugs, Roslyn and Roslynator for C#, OpenGrep, Gitleaks and Trivy, or any tool that writes SARIF. It tracks their issues across commits and measures coverage, duplication and complexity. It applies a quality gate to new code, and it comments on GitLab merge requests and GitHub pull requests.

These pages cover installation, setup and day-to-day use. They are the same Markdown files that live in docs/guide/ of the repository and on qualor.dev/docs.

Pages

  1. Quick start: a server, a project and a first scan in about 15 minutes.
  2. Install the server: Docker Compose, secrets, TLS, backups, upgrades and server settings.
  3. Users, projects and tokens: organisations, roles, projects, and the tokens CI uses.
  4. GitLab: the CI job or CI/CD component, and merge request comments with a commit status.
  5. GitHub: the Actions workflow and a GitHub App for check runs, annotations and comments.
  6. Other CI systems and local scans: Jenkins, Bitbucket, TeamCity or a laptop.
  7. Languages and analyzers: JavaScript, TypeScript, Java, C#, secrets, dependencies, external SARIF files and coverage.
  8. Configuration reference: qualor.yml, environment variables and precedence.
  9. Quality gates, profiles and issues: metrics, new code, gates, rule profiles and issue statuses.
  10. CLI reference: commands, options and exit codes.
  11. Migrating from SonarQube: qualor import sonarqube.
  12. Webhooks and REST API: events, signatures and the most useful endpoints.
  13. Troubleshooting: what common errors mean and how to fix them.
  14. AI prompts: ready-made prompts that let an AI agent roll Qualor out in your company.

How Qualor works

 CI job (qualor/scanner image)                         Qualor server (+ PostgreSQL)
 ┌──────────────────────────────────┐   gzip report    ┌────────────────────────────────┐
 │ qualor scan                      │ ───────────────▶ │ tracks issues across commits   │
 │  • runs the analyzers → SARIF    │                  │ classifies new vs. old code    │
 │  • metrics, duplication, coverage│ ◀─────────────── │ evaluates the quality gate     │
 │  • git diff against the baseline │   gate verdict   │ comments on the MR / PR        │
 └──────────────────────────────────┘   (exit code)    └────────────────────────────────┘
  • The scanner (qualor CLI, shipped in the qualor/scanner image) runs in your CI job. It runs the analyzers, computes metrics, and works out which lines are new against the baseline. It uploads one compressed report, then waits for the gate verdict. It exits with code 1 when the gate fails, and that fails the pipeline.
  • The server (qualor/server image: one container with its own PostgreSQL, or an external one) stores the history. It applies your quality profiles and gates, serves the web UI and the REST API, sends webhooks, and decorates merge requests and pull requests.
  • Nothing calls home. Neither part sends telemetry. The server calls only the GitLab or GitHub you connect and the webhook URLs you configure. The scanner calls only your server. The analyzers run offline.

Where to get it

The images are on Docker Hub: qualor/server, qualor/scanner and qualor/scanner-dotnet. The GitLab CI/CD component is gitlab.com/qualor/qualor. You need nothing else from the repository to run Qualor.

SonarQube and SonarCloud are trademarks of SonarSource SA. Qualor is an independent project. It is not affiliated with, sponsored by or endorsed by SonarSource. The names are used only to describe compatibility and to compare features.