Rules, Rule Types, Severities, Quality Profiles, and Customization: Core Concepts and Mental Model

1. The policy problem

Chapter 08 proved what files enter analysis. Chapter 09 controls what questions Sonar asks of those files. Installed analyzers contribute rule repositories; quality profiles choose and configure the active rules for each language; project association selects the profile; analysis creates issues; the Quality Gate evaluates the resulting state. A change in any of those policy inputs can change issue counts even when the source revision is identical.

2. Mental model: rule repository to release evidence

flowchart TD
A[Analyzer / rule repository] --> R[Rule key + status + defaults]
R --> P[Language quality profile]
SW[Sonar way / parent] --> P
P --> E[Active rules + overrides]
Q[Default or project association] --> E
F[Indexed files from Chapter 08] --> N[Analysis]
E --> N
N --> I[Issues / measures]
I --> G[Quality Gate]
H[Profile + analyzer history] --> V[Governance evidence]
I --> V
G --> V

A rule key such as python:S3776 identifies one check in an analyzer repository. A quality profile is language-specific and selects active rules. A project association chooses a non-default profile for a project. An issue is a result of violating an active rule. A Quality Gate is downstream policy; it does not decide which rules execute.

3. Do not blend these states

4. MQR Mode versus Standard Experience

Current Community Build supports two instance modes. New installations use MQR Mode by default. MQR can assign a rule impacts on security, reliability and/or maintainability, with severities Blocker, High, Medium, Low, Info. Standard Experience retains Bug, Vulnerability, Code Smell, Security Hotspot rule types with Blocker, Critical, Major, Minor, Info severity.

Do not translate the two vocabularies mechanically, and do not treat severity as exploitability, CVSS, business loss or developer performance. Security Hotspots are review targets whose vulnerability status is not known until review.

5. Sonar way and custom profiles

Sonar way is the built-in profile supplied for a language and cannot be edited. A language also has one default profile; projects without an explicit association use it. Custom profiles can be created by Extend, Copy, blank creation or import. SonarSource recommends extending Sonar way for most customization because the child inherits parent evolution such as newly implemented rules, configuration changes and deactivation of deprecated rules.

A child can add rules and can override configurable rule settings; inherited overrides can later be returned to parent policy with Revert to Parent Definition. A copied profile is independent and therefore demands its own update discipline.

6. Read-only inspection checklist

7. Rule status and analyzer provenance

Rules can be Ready, Beta or Deprecated. Commercial analyzers and third-party plugins can also add rules. Therefore a rule inventory needs repository/analyzer provenance and version, not only a display title. After an upgrade, a profile with the same name can still represent changed policy because the underlying analyzer rules evolved.

8. DevOps connection: make policy reproducible

The minimum reconstructable chain is revision → indexed files → analyzer versions → effective quality profiles → active rules/overrides → scanner report → CE task → issue population → gate. That lets a reviewer tell whether a result changed because the source changed or because analysis policy changed.

Knowledge check

Official references and version notes

• Community Build — SonarQube rules — repositories, statuses, rule categories, custom/template rules and mode-dependent severity semantics.
• Community Build — Instance mode overview, including MQR Mode and Standard Experience.
• Community Build — Understanding quality profiles — built-in/default profiles, inheritance, overrides and project association.
• Community Build — Creating a quality profile — Extend, Copy, blank creation and import/export.
• Community Build — Editing a custom quality profile — activate/deactivate rules, customize parameters and Revert to Parent Definition.
• Community Build — Associating a quality profile with projects.
• Sonar Rules — Python S3776 — Cognitive Complexity rule used in the controlled parameter experiment.
• SonarQube releases — current Community Build and Server release identities.