CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/sonarqube-maintainability-gate

Run SonarQube/SonarCloud against production code to surface Code Smells, Bugs, and Maintainability ratings - the maintainability lens rather than the security lens. Production-only scope via sonar.exclusions; test code is reviewed separately. Use when a team wants maintainability and technical-debt ratings gating PRs, or when an existing SonarQube project reports numbers nobody has tied to a quality gate.

71

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with concrete config, commands, and CI integration plus a useful anti-patterns table. It could tighten the introductory background and add an explicit remediation loop for failed quality gates.

Suggestions

Trim the opening paragraph's enumeration of the four Clean Code attributes to the minimum needed to justify the Reliability+Maintainability scope, or move it behind the [Issues introduction] reference.

Add a short 'If the gate is RED' remediation step (e.g. inspect New Bugs/New Code Smells on the diff, fix or mark 'Accepted' with the waiver template, re-run) to close the validate→fix→retry loop.

Consider moving the Limitations waiver template into a small bundled reference file so the main body stays focused on the core workflow.

DimensionReasoningScore

Conciseness

Mostly lean with tables, copy-paste blocks, and justified rationale ('Why separate sonar.tests vs sonar.sources'); the intro paragraph naming the three software qualities and four Clean Code attributes is slightly more background than strictly required, keeping it just shy of fully efficient.

4 / 5

Actionability

Provides fully executable, copy-paste-ready artifacts: a complete sonar-project.properties block, scanner CLI invocations with PR-decoration flags, and a GitHub Actions YAML workflow covering both scan and quality-gate check.

5 / 5

Workflow Clarity

Five clearly sequenced steps (Install → Scope → Run → Read dashboard → Gate) with an explicit validation checkpoint (quality-gate-action 'fails the build if it's RED') and an anti-patterns table acting as a checklist; slight gap is the absence of an explicit fix-and-retry loop when the gate is RED.

4 / 5

Progressive Disclosure

Well-organized into clearly headed sections with one-level-deep external references ([Issues introduction], [SonarQube docs sitemap]) and no nested reference chains; all content lives inline in a single file with no bundle files to split into, which is appropriate but leaves minor room for offloading the anti-patterns/limitations detail.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, third-person description that clearly states capabilities, gives explicit 'Use when' triggers, and explicitly differentiates itself from the sibling security skill. Minor gap: omits generic static-analysis synonyms a user might voice.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Run SonarQube/SonarCloud against production code to surface Code Smells, Bugs, and Maintainability ratings', gating PRs, and scoping via 'sonar.exclusions' — giving comprehensive coverage of what the skill does.

5 / 5

Completeness

Explicitly answers both what ('Run SonarQube/SonarCloud ... to surface Code Smells, Bugs, and Maintainability ratings') and when ('Use when a team wants maintainability and technical-debt ratings gating PRs, or when an existing SonarQube project reports numbers nobody has tied to a quality gate').

5 / 5

Trigger Term Quality

Strong natural keyword coverage including synonyms ('SonarQube/SonarCloud', 'Code Smells', 'Bugs', 'Maintainability', 'quality gate', 'technical-debt ratings gating PRs'), though broader static-analysis terms like 'static analysis' or 'lint' are absent.

4 / 5

Distinctiveness Conflict Risk

Explicitly carves a distinct niche — 'the maintainability lens rather than the security lens' and 'qa-security-scanning's sonarqube-rules skill covers the Security lens; this skill covers the Reliability + Maintainability lens' — minimizing conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents