In Chapter 10, Static Code Analysis with SonarQube, we explained the importance of implementing static code analysis practices. For open source projects, code analysis is more important because the source code and its binaries are published publicly.
One of the roles of open source is to provide code and components that can be used in enterprise applications, so this code must be written correctly and without any security fails.
In this book, we have discussed that SonarQube, with its installations and uses, is one of the major tools that allows code analysis for enterprise applications. However, it requires the installation of an on-premises infrastructure, which is more expensive for a company.
For open source project code analysis, it is possible to use SonarCloud (https://sonarcloud.io/), which is exactly the same product as SonarQube but comes...
