SlopGrade vs SonarQube
SonarQube measures code quality — bugs, code smells, coverage, duplication — plus security, behind a quality gate, on a server you host (or SonarQube Cloud, formerly SonarCloud). The SlopGrade gate ignores quality metrics and does one security thing: block the high-severity leaks AI writes, deterministically, per PR, with your source staying in the runner by default and no server for you to operate.
SonarQube is the right tool when you want a durable, org-wide view of code quality and technical debt with a configurable quality gate and broad language coverage. It also means running (or paying for) a server and tuning what the quality gate enforces. The SlopGrade gate needs no server of yours, has no quality metrics, and almost no configuration — it is a single deterministic security gate, focused on the leaks that turn into breaches, that you add to a workflow file in two minutes.
SlopGrade vs SonarQube
Pick SonarQube when code quality and technical-debt tracking across the whole org is the goal and you're happy to run the server. Pick SlopGrade when you specifically want to block security leaks in AI-written code on every PR, with no infrastructure and your source staying in the runner by default. On private repos the deep scan (heisen-slop) is a paid opt-in — the two are complementary, not mutually exclusive.
Is SlopGrade a SonarQube replacement?
No — different jobs. SonarQube tracks code quality and technical debt org-wide; SlopGrade does not measure quality at all. It replaces the security-gate piece with a deterministic leak gate that keeps your source in the runner by default and adds cross-tenant isolation. On private repos the deep scan (heisen-slop) is a paid opt-in. Teams often keep SonarQube for quality and add SlopGrade for the security block.
Do I need to run a server?
No. SlopGrade is a GitHub Action that runs on your existing runner via keyless OIDC — there is nothing to host, patch, or scale.