A SonarQube-Style PR Gate in GitHub Actions, With No Server

You can get a pass/fail pull request check in GitHub Actions without running a SonarQube server. One command writes the workflow: it scans the lines each pull request changes and fails the check when the gate fails. It needs no account, no secrets and no lines-of-code license.

pip install skylos
skylos cicd init --no-upload

What each option needs

The workflow

skylos cicd init --no-upload writes .github/workflows/skylos.yml. These are the steps it generates on Skylos 4.47.2, shortened:

name: Skylos Analysis

"on":
  pull_request:
  push:
    branches: ["main", "master"]

permissions:
  contents: read

jobs:
  skylos:
    name: Skylos Quality Gate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@<pinned sha>
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@<pinned sha>
        with:
          python-version: '3.12'
      - name: Install Skylos
        run: python -I -m pip install 'skylos[dart]==4.47.2'
      - name: Run Skylos Analysis
        run: |
          pr_base_ref="origin/${GITHUB_BASE_REF:-main}"
          skylos . --danger --quality --ai-defects --secrets --sca --baseline \
            --diff-base "$pr_base_ref" --diff "$pr_base_ref" --json -o skylos-results.json
      - name: Quality Gate
        run: skylos cicd gate --input skylos-results.json --summary
      - name: GitHub Annotations
        run: skylos cicd annotate --input skylos-results.json

The generated file also pins every action to a commit SHA, runs a full scan on pushes to main, and adds a step that posts review comments on the pull request.

What the steps do:

• Run Skylos Analysis scans for security issues, secrets, vulnerable dependencies, quality problems and coding-agent mistakes, and keeps only findings on the lines the pull request changed.
• Quality Gate fails the job when the gate fails and writes a summary to the job page.
• GitHub Annotations puts each finding on its line in the pull request's "Files changed" tab.

Make it block merges

1. Merge the workflow file, then open any pull request so the check runs once.
2. In the repository settings, add a branch protection rule (or a ruleset) for your default branch.
3. Require the status check Skylos Quality Gate.

A failing gate now blocks the merge until the finding is fixed or explicitly suppressed with # skylos: ignore[SKY-…] on that line.

Try it locally first

The same scan runs on your machine, so you can see what the gate will flag before you commit the workflow:

skylos . --danger --quality --ai-defects --secrets --sca --diff-base origin/main

What it doesn't do

• No coverage or duplication gates. SonarQube can fail a pull request on test coverage or duplicated lines; Skylos doesn't.
• Narrower language depth. Python has Skylos's deepest coverage; check language support for yours.
• Pinned version. The workflow pins skylos==4.47.2. Bump the pin in the workflow file when you upgrade.

For the full comparison, see SonarQube alternative: Skylos vs SonarQube.