SonarQube Measures and Metrics
Numbers drive every SonarQube decision. A measure is a single number about your code, such as the count of bugs or the percentage of tested lines. Reading these numbers correctly turns a dashboard into a clear health report.
The Report Card Picture
A school report card shows marks per subject plus an overall grade. SonarQube works the same way. Each subject is a measure, and the grades from A to E give a quick summary.
Project Report Card ┌──────────────────┬───────────┬───────┐ │ Subject │ Mark │ Grade │ ├──────────────────┼───────────┼───────┤ │ Reliability │ 3 bugs │ C │ │ Security │ 0 vulns │ A │ │ Maintainability │ 4% debt │ A │ │ Coverage │ 72% │ - │ │ Duplications │ 6.1% │ - │ └──────────────────┴───────────┴───────┘
The Three Rating Areas
Reliability
Reliability counts bugs, which are mistakes that can break the program at run time. The rating depends on the most severe open bug.
- A means no bugs.
- B means at least one minor bug.
- C means at least one major bug.
- D means at least one critical bug.
- E means at least one blocker bug.
Security
Security counts vulnerabilities that attackers could exploit. The same A to E scale applies, based on the worst open vulnerability. Security hotspots appear as a separate review percentage.
Maintainability
Maintainability counts code smells and converts them into estimated fix time, called technical debt. The rating compares that time with the size of the project.
Size Measures
- Lines of Code counts lines that hold real code, skipping blanks and comments.
- Files counts analyzed source files.
- Functions counts methods and functions.
- Comment Lines (%) shows how much of the file explains itself.
Lines of code also affect commercial license size, so teams watch this number.
Complexity Measures
Cyclomatic Complexity
This number counts independent paths through code. Every if, loop, and case adds one path. A function with many paths needs many tests.
Cognitive Complexity
This number estimates how hard a human finds the code to read. Nested conditions raise the score faster than flat ones.
Quality Measures
Coverage
Coverage shows the share of lines or conditions that tests execute. SonarQube imports this number from a test report and does not run tests itself.
Duplications
Duplicated lines density shows the percentage of lines that appear in more than one place. Lower is better, because every copy doubles the bug-fix work.
Overall Code and New Code
Every measure exists in two versions. Overall Code covers the entire project. New Code covers only recent changes, based on a reference point such as the last release. Teams focus on New Code first, since it shows the effect of today's work without the weight of old history.
Reading a Trend
Coverage over five analyses
80% │ ●
70% │ ● ●
60% │ ● ●
50% │ ●
└────────────────────────────
Mon Tue Wed Thu Fri
A single number tells you where you stand. A trend tells you where you are heading. Open the Activity tab of any project to see history graphs for each measure.
Practical Reading Order
- Check the quality gate status for a pass or fail answer.
- Scan the three ratings for any letter below A.
- Look at coverage and duplications on New Code.
- Open the issue list for the weakest area.
Common Mistakes
- Chasing 100% coverage while ignoring test quality.
- Comparing lines of code between projects in different languages.
- Reading Overall Code numbers only and missing recent drops.
Quick Recap
Ratings summarize risk, size measures describe scale, complexity measures predict effort, and coverage plus duplications describe discipline. Combine them for the full picture.