baekchangjoon/SonarQube AI Agent
Scan with SonarQube, triage false positives with an LLM judge, fix the real issues with an LLM agent, and verify by re-scan.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 9, 2026
- License
- None
Pinned Snippet
uses: baekchangjoon/sonarqube-ai-agent@6ce54a8a3eee3593d544f065e60c3e51f1634178 # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | pr-premerge | post-merge | nightly-batch | summary | yes | — |
| config | Path to the orchestrator config.yml in your repository | yes | — |
| project-dir | Directory of the project to scan/fix | no | ${{ github.workspace }} |
| repo | owner/repo for PR comments (pr-premerge) | no | ${{ github.repository }} |
| pr-number | Pull request number (pr-premerge) | no | "" |
| pr-branch | PR branch name (scanner.pr_mode: native) | no | "" |
| pr-base | PR base branch (scanner.pr_mode: native) | no | main |
| cleanup | Delete the ephemeral PR project afterwards (true/false) | no | true |
| install-claude-code | Install the Claude Code CLI (set false if you install your own agent CLI) | no | true |
| python-version | Python version for the orchestrator | no | 3.12 |
Outputs
| name | description |
|---|---|
| result-json | Path to the run result JSON |
| issues-found | Issues found by the scan |
| issues-skipped-as-fp | Issues skipped as false positives |
| fixes-verified | Fixes confirmed by re-scan |