# SonarQube / Semgrep

Code inspection you host. SonarQube Community is LGPL-3.0; Semgrep OSS is LGPL-2.1 — SonarCloud without the analysis seat.

**Replaces:** SonarCloud

**Tier:** Medium

## Problem

SonarCloud is hosted static analysis from Sonar. You wanted that scan on a box you run. SonarQube is LGPL-3.0 (SonarSource/sonarqube) — Community Build is the OSI path; commercial editions are separate. Semgrep is LGPL-2.1 (semgrep/semgrep) if you want pattern-based SAST. This is not every SonarQube commercial rule pack or SonarCloud organization SKU. Dependency CVEs stay on /replace/snyk.

## Stack

- [SonarQube](https://www.sonarqube.org) — LGPL-3.0 continuous inspection (Community Build; skip commercial editions)
- [Semgrep](https://semgrep.dev) — LGPL-2.1 pattern-based static analysis if you want that CLI

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| SonarCloud (small team) | $1,200 | SonarQube Community or Semgrep OSS |

**About $1,200 / year** on a small team, before you count lock-in.

## Deploy on Railway

Placeholder: SonarQube + a database and a volume. Bind HTTP to 0.0.0.0:$PORT. Semgrep is a CLI you run in CI. No one-click template in this repo yet — Start on Railway. Image CVEs stay on /stacks/trivy-scan.

[Start on Railway](https://c17.io/go/railway/sonarqube-lint?from=%2Fstacks%2Fsonarqube-lint.md)

[Trivy / Grype if this is dependency and image CVEs, not code quality](https://c17.io/stacks/trivy-scan)

## AGENT_PROMPT

```
Replace SonarCloud with SonarQube Community (preferred server) or Semgrep OSS (CLI).

- SonarQube: official image, persist Elasticsearch/data, create one project, run the scanner on the repo you still pay SonarCloud for.
- Do not enable commercial editions and call it Community. Semgrep if you only need pattern rules in CI.
- Write AGENT_PROMPT.md. Image CVEs stay on /stacks/trivy-scan.
```

## FAQ

### SonarQube or Semgrep?

SonarQube if you want the dashboard and history (the SonarCloud shape). Semgrep if you want a CLI of rules in CI. Pick one as the daily driver.

### Community or commercial?

This page is Community Build (LGPL-3.0). Commercial editions are a different license. Skip them on the OSS path.

### Is this Snyk?

No. Snyk is dependency/image vulns — /replace/snyk.

Source: https://c17.io/stacks/sonarqube-lint