CLI reference

The qualor CLI is the entrypoint of the qualor/scanner and qualor/scanner-dotnet images: docker run qualor/scanner:<tag> scan runs qualor scan. In GitLab CI, set entrypoint: [''] and call qualor in script. qualor help (or --help) prints the usage.

qualor scan

qualor scan [--config PATH] [--project-key KEY] [--sarif PATH]... [--coverage PATH]...
            [--branch NAME] [--mr ID --mr-target BRANCH] [--tag NAME] [--no-wait]
            [--token-file PATH] [--server-url URL] [--ca-file PATH]
            [--dry-run --output report.json.gz]
            [--gitlab-code-quality FILE] [--gitlab-sast FILE] [--gitlab-dependency-scanning FILE]

It runs the analyzers, computes metrics, duplication, coverage and the diff against the baseline, and uploads one gzip report. Then it waits for the quality gate, prints the failed conditions and exits. Run it from the repository root. In a tag pipeline, or with --tag, it records the checkout as a version instead.

The GitLab report paths must be inside the working directory.

Versions. The first line is the scanner’s version (qualor 0.15.0 (linux-x64)). With a server configured, it then logs the server’s (server https://qualor.example.com runs Qualor 0.15.0). If the two are different releases (0.3 against 0.4), it warns and names the scanner tag that matches the server. If the server knows of a newer release (its update check), the scanner logs Qualor 0.15.0 is available … and the tag to move to. This check never fails a scan. A server that does not answer it is noted only in the debug log.

Analyzer times. Each analyzer that ran logs one line when it finishes, such as sonarjs: 83.2 s, 12 findings. The time is the one in the report. The count is what the analyzer reported, before Qualor leaves out duplicates and files outside the scope. A skipped or failed analyzer logs its reason instead.

AI review. On a merge request, when AI review is on for the project, the scan also uploads a snapshot of the repository right after the report. Its log lines start with AI review. A failure there is only a warning: the exit code stays the quality gate’s. A scan that exits 3 sends no snapshot.

qualor dotnet begin | end | abort

The C# route (Languages and analyzers):

qualor dotnet begin [--config PATH]      # before your build: install the MSBuild hook
dotnet build --no-incremental            # your own build
qualor dotnet end [qualor scan options]  # remove the hook, read the Roslyn logs, run Qualor's Roslyn taint engine (C# rules), then run qualor scan
qualor dotnet abort                      # after a failed build: clean up, scan nothing

qualor validate

qualor validate [--config PATH]

It checks qualor.yml and prints the resolved configuration, with every default filled in and secrets redacted.

qualor import sonarqube

It imports issue statuses, quality gates, and projects with their gate assignments from SonarQube Server or SonarQube Cloud. It imports quality profiles as their rule mappings are reviewed. See Migrating from SonarQube.

qualor version

It prints the CLI version, its platform and the bundled grammars.

Exit codes

A tag scan has exit codes of its own (Releases and versions).

Set QUALOR_LOG_LEVEL=debug to see each analyzer’s command and output.