# Qualor documentation

Qualor is an open-source, self-hosted code quality platform. It is an alternative to SonarQube with
no lines-of-code licence. It runs open-source analyzers you already know: ESLint, PMD, SpotBugs,
Roslyn and Roslynator for C#, OpenGrep, Gitleaks and Trivy, or any tool that writes SARIF. It tracks
their issues across commits and measures coverage, duplication and complexity. It applies a quality
gate to **new code**, and it comments on GitLab merge requests and GitHub pull requests.

These pages cover installation, setup and day-to-day use. They are the same Markdown files that live in
[`docs/guide/`](https://github.com/qualor-dev/qualor/tree/main/docs/guide) of the repository and on
[qualor.dev/docs](https://qualor.dev/docs).

## Pages

1. [Quick start](https://qualor.dev/docs/quick-start.md): a server, a project and a first scan in about 15 minutes.
2. [Install the server](https://qualor.dev/docs/install-server.md): Docker Compose, secrets, TLS, backups, upgrades and
   server settings.
3. [Users, projects and tokens](https://qualor.dev/docs/users-projects-tokens.md): organisations, roles, projects, and the
   tokens CI uses.
4. [GitLab](https://qualor.dev/docs/gitlab.md): the CI job or CI/CD component, and merge request comments with a commit
   status.
5. [GitHub](https://qualor.dev/docs/github.md): the Actions workflow and a GitHub App for check runs, annotations and
   comments.
6. [Other CI systems and local scans](https://qualor.dev/docs/other-ci.md): Jenkins, Bitbucket, TeamCity or a laptop.
7. [Languages and analyzers](https://qualor.dev/docs/languages-and-analyzers.md): JavaScript, TypeScript, Java, C#,
   secrets, dependencies, external SARIF files and coverage.
8. [Configuration reference](https://qualor.dev/docs/configuration.md): `qualor.yml`, environment variables and
   precedence.
9. [Quality gates, profiles and issues](https://qualor.dev/docs/quality-gates.md): metrics, new code, gates, rule
   profiles and issue statuses.
10. [CLI reference](https://qualor.dev/docs/cli.md): commands, options and exit codes.
11. [Migrating from SonarQube](https://qualor.dev/docs/migrate-from-sonarqube.md): `qualor import sonarqube`.
12. [Webhooks and REST API](https://qualor.dev/docs/webhooks-and-api.md): events, signatures and the most useful
    endpoints.
13. [Troubleshooting](https://qualor.dev/docs/troubleshooting.md): what common errors mean and how to fix them.
14. [AI prompts](https://qualor.dev/docs/ai-prompts.md): ready-made prompts that let an AI agent roll Qualor out in your
    company.

## How Qualor works

```text
 CI job (qualor/scanner image)                         Qualor server (+ PostgreSQL)
 ┌──────────────────────────────────┐   gzip report    ┌────────────────────────────────┐
 │ qualor scan                      │ ───────────────▶ │ tracks issues across commits   │
 │  • runs the analyzers → SARIF    │                  │ classifies new vs. old code    │
 │  • metrics, duplication, coverage│ ◀─────────────── │ evaluates the quality gate     │
 │  • git diff against the baseline │   gate verdict   │ comments on the MR / PR        │
 └──────────────────────────────────┘   (exit code)    └────────────────────────────────┘
```

- The **scanner** (`qualor` CLI, shipped in the `qualor/scanner` image) runs in your CI job. It runs the
  analyzers, computes metrics, and works out which lines are new against the baseline. It uploads one
  compressed report, then waits for the gate verdict. It exits with code 1 when the gate fails, and
  that fails the pipeline.
- The **server** (`qualor/server` image: one container with its own PostgreSQL, or an external one)
  stores the history. It
  applies your quality profiles and gates, serves the web UI and the REST API, sends webhooks, and
  decorates merge requests and pull requests.
- Nothing calls home. Neither part sends telemetry. The server calls only the GitLab or GitHub you
  connect and the webhook URLs you configure. The scanner calls only your server. The analyzers run
  offline.

## Where to get it

The images are on Docker Hub: [`qualor/server`](https://hub.docker.com/r/qualor/server),
[`qualor/scanner`](https://hub.docker.com/r/qualor/scanner) and
[`qualor/scanner-dotnet`](https://hub.docker.com/r/qualor/scanner-dotnet). The GitLab CI/CD component
is [`gitlab.com/qualor/qualor`](https://gitlab.com/qualor/qualor). You need nothing else from the
repository to run Qualor.

SonarQube and SonarCloud are trademarks of SonarSource SA. Qualor is an independent project. It is not
affiliated with, sponsored by or endorsed by SonarSource. The names are used only to describe
compatibility and to compare features.