Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Quality Gates with SonarQube: Community Build or Server, Quality Profiles, New-Code Gates and CI Integration
SonarQube's default gate only looks at new code: zero new issues and at least 80% coverage on new code. In Bookstore a 'similar books' endpoint with a clean build and green tests failed the gate with 10.3% new-code coverage and passed after two tests. The post covers running the Community Build with PostgreSQL in Docker, SonarScanner for .NET, the Sonar way core profile, double reporting with Roslyn, the stale coverage report trap and the Community Build's lack of PR analysis, with real output.
What Changed in Static Analysis: .NET 5–11 Analyzers, From TSLint to ESLint 10, TypeScript 7 and Next-Generation Linters
Analyzers have been part of the SDK since .NET 5, and every release brings new rules: the same code gave zero warnings with the .NET 10 SDK and four with the .NET 11 SDK (CA2026, CA2027, CA1877, CA2028). The post covers the .NET 6–11 rule history, CA2028 missing source-generated regexes, why automatic .eslintrc to flat config migration isn't enough with angular-eslint 22, TypeScript 7 holding back typescript-eslint, Oxlint and Biome results on Bookstore, and Sonar's new names.