sonarqube

SonarQube analyzes your code for bugs, security vulnerabilities, and code smells across 30+ languages. It integrates with every major CI/CD pipeline and gives you a quality gate you can fail builds on. The Community Edition is free and self-hosted.

Deploy via Docker or a dedicated server. You need 2GB+ RAM for the process, plus a Postgres database. The Docker Compose setup handles it in minutes. The web interface is comprehensive and developers actually use it without being forced. Quality gates plug directly into your CI pipeline.

Solo developers and small teams run the Community Edition free. The Developer Edition adds branch analysis and deeper security rules starting at around 150 USD/year per developer. Enterprise Edition adds datacenter mode and portfolio management.

The catch: Community Edition does not do branch analysis. You analyze main only. If your team uses feature branches heavily, you either upgrade to Developer Edition or run multiple SonarQube instances.