SonarQube Alternate Sources

The United States Air Force is conducting market research to identify and assess commercially available alternatives to SonarQube in support of Platform One (P1) mission requirements. The Government seeks to identify solutions capable of supporting secure software development lifecycle (SDLC) practices, automated code inspection, vulnerability identification, coding standards enforcement, quality gate management, developer workflow integration, and enterprise scalability across Platform One value streams and software delivery pipelines. • The solution should provide enterprise software code quality analysis, static application security testing (SAST), code vulnerability detection, technical debt analysis, and software compliance support within a Government security-compliant DevSecOps environment. • The solution should support secure software development lifecycle (SDLC) practices, automated code inspection, vulnerability identification, coding standards enforcement, quality gate management, developer workflow integration, and enterprise scalability. • The solution should be able to integrate with CI/CD pipelines and provide API extensibility. • The solution should provide reporting and dashboard capabilities, as well as data ownership, storage, and retention controls for on-prem environments.