supersonar 0.2.0

A SonarQube-like static analysis CLI for Python projects.

supersonar

supersonar is a lightweight, SonarQube-inspired static analysis CLI for Python projects. It is designed for local use and CI pipelines via pip install.

Quick start

pip install .
supersonar scan . --format json

The scanner performs real code checks (AST + regex), including:

• dynamic execution (eval/exec)
• broad exception handlers
• hardcoded secret-like assignments
• TODO/FIXME markers

CI usage

pip install supersonar
supersonar scan . \
  --format sarif \
  --out reports/supersonar.sarif \
  --fail-on high \
  --max-high 0 \
  --max-critical 0 \
  --coverage-xml coverage.xml \
  --min-coverage 80

Config (supersonar.toml)

[scan]
exclude = [".git", ".venv", "venv", "build", "dist", "__pycache__"]
coverage_xml = "coverage.xml"

[quality_gate]
fail_on = "high"
max_issues = 200
max_high = 0
max_critical = 0
min_coverage = 80.0

[report]
format = "json"

Quality gates

• fail_on: fail if any issue exists at/above severity
• max_issues: fail if total issues exceed threshold
• max_low, max_medium, max_high, max_critical: per-severity caps
• min_coverage: minimum line coverage percentage from Cobertura XML

Generate coverage.xml in Python projects with:

python -m pip install coverage
coverage run -m pytest
coverage xml -o coverage.xml