sonarqube-checklisted

# SonarQube quality gate — produce the real report, locally <!-- routing-eval reads this line; it lives in the BODY so the always-on skill LISTING stays inside Claude Code's budget (1% of the context window) — an overflowing listing gets descriptions truncated or dropped, which strips the very keywords a match depends on. --> Trigger phrases: "sonarqube", "quality gate", "code smell", "sonar scan", "sonar rapor", "A rating" **Only a SonarQube analysis can say "rating A, 0 findings".** A clean `build` says the compiler was happy — a different claim, about a different rule set. Passing one off as the other is how a team is told the code is clean and then opens a report full of findings. You do **not** need a company server or someone else's token to get the real thing: **SonarQube Community Build is free, needs no licence key, and runs in one Docker container on this machine.** That is the default path here — the gate is produced locally, offline, and it is a genuine SonarQube verdict, not a proxy for one. Language-agnostic on purpose: SonarQube covers 20+ languages plus IaC (Terraform, Kubernetes, Dockerfile). Detect what the project actually uses; never assume a stack. ## Step 1 — get a real analysis (pick the first that applies) **a) The project already has a SonarQube** → use it, and skip to step 2. **b) It does not → stand one up locally.** No licence, no external account, nothing leaves the machine. Two ways, and **Docker is not required**. > **Nothing h