SonarQube Community Build doesn't analyze pull requests. Sonar's documentation says pull request analysis is available starting in Developer Edition, and Sonar's editions page lists "automatically analyze feature and maintenance branches and pull requests" from Developer Edition up. On Community Build, only your main branch is analyzed.
You have three ways to get pull requests checked before they merge.
| Option | Cost | Supported by SonarSource | What you get |
|---|---|---|---|
| Upgrade to Developer Edition or SonarQube Cloud | Priced by lines of code | Yes | Sonar's own branch and pull request analysis and decoration |
| Community branch plugin | Free (LGPL-3.0) | No | Branch and pull request analysis on Community Build |
| A separate free PR gate, such as Skylos | Free (Apache-2.0) | Not applicable | Checks on the changed lines of every pull request, in your CI |
Option 1: upgrade to a paid edition
This is the supported route. On SonarQube Server, Developer Edition adds branch and pull request analysis, and Enterprise Edition adds pull request decoration for monorepos and portfolio features (editions). Server editions are priced per instance, per year, by lines of code.
On SonarQube Cloud, the Team plan starts at about $34 a month for up to 100k lines of code, and there's a free tier for private projects up to 50k lines. Public open-source repositories are free.
Choose this if you already rely on SonarQube's quality gates, coverage and duplication conditions, or portfolio views, and the cost fits.
Option 2: the community branch plugin
The sonarqube-community-branch-plugin adds branch analysis and pull request decoration to the Community version of SonarQube. It is open source (LGPL-3.0), actively released (26.5.0 in June 2026) and widely used.
Two things to know before you install it:
- No support from SonarSource. The plugin's README says it "is not maintained or supported by SonarSource and has no official upgrade path" to the commercial editions.
- Version lock. Each plugin release matches one SonarQube version (plugin 25.4.0 works with SonarQube 25.4.x), so every SonarQube upgrade waits for a matching plugin release.
- Migrating later is a risk. If you move to a commercial edition after using the plugin, the README warns that "this may result in some or all of your data being lost".
Choose this if you want to stay entirely on SonarQube and can keep the two versions in step.
Option 3: keep Community Build, add a free PR gate
Community Build keeps analyzing your main branch; a separate tool checks every pull request. Skylos is free and open source (Apache-2.0) and runs in your CI with no server and no account.
pip install skylos
skylos cicd init --no-upload
skylos cicd init writes a GitHub Actions workflow (.github/workflows/skylos.yml) that scans the pull request's changed lines against its base branch and fails the check when the gate fails. --no-upload keeps everything in your CI. You can run the same scan locally first:
skylos . --danger --quality --ai-defects --secrets --diff-base origin/main
What it checks on each pull request:
- Security, secrets and dependencies: injection flows, hard-coded secrets and known-vulnerable dependency versions.
- Dead code and quality: unused functions, imports and files, plus complexity and nesting.
- Coding-agent mistakes: imports of functions a module doesn't export (TypeScript, Python, Java and Go) and dependencies that don't exist on the registry (npm, PyPI and Go).
Skylos doesn't replace SonarQube's quality profiles, coverage and duplication gates, or portfolio views. Language depth differs too: Python has Skylos's deepest coverage (language support).
To see Skylos findings next to SonarQube's, write SARIF and import it:
skylos . --sarif skylos.sarif
# then, in your SonarQube scanner configuration:
# sonar.sarifReportPaths=skylos.sarif
SonarQube documents SARIF import in importing issues from SARIF reports.
Choose this if you want every pull request checked for free and are happy to keep SonarQube for the main branch.
Which option fits
- You need Sonar's own pull request quality gate: upgrade (option 1).
- You must stay on SonarQube only and can manage version upgrades: the community plugin (option 2).
- You want free pull request checks today, with no server changes: add a PR gate next to Community Build (option 3).