Qodana

Qodana is JetBrains' static code analysis platform: it runs IDE inspections in CI with quality gates and security checks, licensed per active contributor.

Qodana stops code that breaks a team's agreed standards at the pipeline, failing the build when new problems cross a threshold the team sets. JetBrains builds it on the linters of its own IDEs and runs that analysis on the CI side. The checks developers know from IntelliJ IDEA therefore also judge every build. Results land in Qodana Cloud, where each project keeps a history of its reports. The Baseline sorts findings into new, unchanged and resolved, so an existing codebase can adopt Qodana without first fixing every problem it already has. Quick-Fix repairs problems automatically and can open a pull request with the fixes applied. FlexInspect lets a team write its own inspections in Kotlin on the IntelliJ API, and inspection profiles in qodana.yaml set which checks run and at what severity. Security work covers taint analysis for SQL injection, cross-site scripting and path traversal, a vulnerability checker for dependencies, a third-party license audit and a hard-coded password inspection. The Insights dashboard gathers results at team and organization level. Qodana suits development teams that want agreed quality standards checked on every change. It analyzes Java, Kotlin, Python, .NET, C, C++, PHP, JavaScript, TypeScript and Go, with framework support for Spring, Django and WordPress. It also serves open-source maintainers, engineering leads comparing teams, and organizations that need license audits and security checks. Companies that keep analysis on their own infrastructure run the Self-Hosted edition. Qodana is licensed per active contributor, counting the people who push commits to registered projects. Teams wire Qodana into the pipeline they already run, whether GitHub Actions, GitLab, TeamCity, Jenkins or Azure Pipelines. On GitHub the Qodana action posts a summary of results on each pull request and can push its fixes back. Coverage reports from JaCoCo, Coverage.py or Jest feed a quality gate on fresh code, so a build fails when coverage of new code drops below the team's threshold. Self-Hosted installs with a CLI installer or a Kubernetes Helm chart on the company's own servers. It fits teams that want quality and security findings raised by the build on every pull request, before the code is merged.