SonarQube vs CodeQL
CodeQL is the strongest free security analysis available to open-source projects and the most licence-encumbered option for everyone else. SonarQube is a maintainability platform with security bolted on as a paid add-on. Comparing them fairly means being clear about which half of the problem you are trying to solve, and reading the CodeQL terms before you plan a migration.
Pick CodeQL if your code is on GitHub, security is the priority, and either your repositories are public (in which case code scanning is free) or you are willing to buy GitHub Code Security at the listed $30 per active committer per month. Stay on SonarQube if you need maintainability metrics and a technical-debt model, if your forge is not GitHub, or if you want a free self-hosted engine you can legally point at private code.
Side by side
SonarQube vs CodeQL at a glance
| SonarQube | CodeQL and Code Security | |
|---|---|---|
| Primary job | Maintainability plus security, with a gate | Vulnerability discovery by data-flow analysis |
| Analysis model | Rules over an AST, per file and project | ✓ queries over a semantic database |
| Bills by | ✗ lines of code | Active committer |
| Entry paid price | Cloud Team from $34/mo at 100k LOC | Code Security $30/committer/mo |
| Secrets scanning | Advanced Security add-on | Secret Protection, separate at $19 |
| Free for public repos | ✓ SonarQube Cloud, free forever | ✓ code scanning at no cost |
| Free on private code | ✓ Community Build, single branch | ✗ licence excludes it |
| Licence limits | LGPL v3 on Community Build | ✗ CLI: open source only, no CI database generation |
| Forge independence | ✓ GitHub, GitLab, Bitbucket, Azure DevOps | ✗ assumes GitHub |
| Maintainability metrics | ✓ complexity, duplication, debt model | ✗ none |
| Custom rules | Plugin work | QL, a real query language to learn |
| Language coverage | ✓ 34 to 40 plus, incl. COBOL and ABAP | Roughly a dozen mainstream languages |
| Best for | Quality gates across a mixed estate | Security-first teams already on GitHub |
Sources: GitHub pricing · GitHub changelog, March 2025 · CodeQL CLI docs and terms · Sonar plans and pricing. Compiled July 2026.
Where CodeQL wins
A genuinely different depth of analysis
CodeQL compiles your code into a relational database and runs queries against it, so a query can follow untrusted input across files, functions and framework boundaries to the place it reaches a sink. That is the class of finding, injection and taint reaching a dangerous call, that rule-per-file engines systematically miss. SonarQube's own deep security analysis sits behind the Advanced Security add-on, which is quoted rather than listed.
Free, and unusually good, for open source
Code scanning with CodeQL runs at no cost on GitHub-hosted public repositories, with results in the security tab and on pull requests. For a maintainer, that is enterprise-grade SAST for nothing, which no SonarQube tier matches on security depth even though SonarQube Cloud is also free for public projects.
Billing that tracks the team, not the codebase
Code Security is $30 per active committer per month, so a small team on a large legacy repository pays for the team. SonarQube meters lines of code, which is the same inversion that pushes many teams off it: the monolith you inherited costs more to scan every year even though nobody is adding to it.
One less system in the loop
If you are on GitHub, findings, triage, dismissals and required checks all live where the review already happens. No second dashboard, no separate identity, no webhook plumbing.
Where SonarQube still wins
Read the CodeQL CLI terms before you plan anything. The licence permits use on open-source codebases and does not permit generating CodeQL databases in an automated CI or CD system without a commercial licence, which is the exact usage a self-hosted replacement for SonarQube would need. So for private code the honest comparison is not "SonarQube versus free CodeQL", it is SonarQube versus GitHub Code Security at $30 per active committer per month. SonarQube Community Build, by contrast, is LGPL v3 and you may point it at anything you own.
Then the scope. CodeQL has no maintainability model: no cognitive complexity, no duplication percentage, no debt estimate, no quality gate in those terms, and its language list is roughly a dozen mainstream languages rather than SonarQube's 34 to 40 plus with COBOL, ABAP and Apex at the top end. Custom rules mean learning QL, a real declarative query language, where a Semgrep rule is just a code snippet. And the whole arrangement assumes GitHub, while SonarQube treats GitHub, GitLab, Bitbucket and Azure DevOps alike.
Migrating SonarQube to CodeQL
The path most teams take:
1. Settle the licence question first. Public repositories: enable code scanning and you are done. Private repositories: price GitHub Code Security for your active committer count and compare it with your Sonar renewal, because the free CLI is not a lawful option there.
2. Turn it on. Enable default setup for code scanning per repository, or commit a codeql-analysis workflow when you need custom query packs or build steps for compiled languages. Set the pull-request check to required once the alert volume is triaged.
3. Keep something for style. CodeQL will not enforce naming, formatting or complexity, so add or keep per-language linters: ESLint, Ruff, Checkstyle, clang-tidy. This is the step teams skip and then miss.
4. What does not move. Complexity and duplication history, technical-debt estimates, past gate results and SonarQube issue decisions. There is no import path, so archive the instance read-only if you need the audit trail.
Common questions
FAQ: SonarQube vs CodeQL
Is CodeQL free?
On public repositories, yes: CodeQL code scanning runs at no cost on GitHub-hosted public repos. On private code the picture changes, because the CodeQL CLI licence permits use only on open-source codebases and does not permit generating databases in an automated CI or CD system without a commercial licence. In practice that means private repositories need GitHub Code Security, which GitHub lists at $30 per active committer per month after it split Advanced Security into Code Security and Secret Protection in March 2025.
Does CodeQL replace SonarQube?
It replaces the security half and none of the rest. CodeQL is a semantic analysis engine built for finding vulnerabilities through data-flow and taint tracking; it does not measure cognitive complexity, duplication or technical debt, and it has no quality-gate concept in SonarQube's sense. Teams that move usually keep per-language linters for style and accept losing the aggregate debt score. If a maintainability number is what your organisation reports on, CodeQL will not produce it.
Do I have to host my code on GitHub?
Effectively yes, for the paid path. Code Security is billed and administered through GitHub and the findings surface in GitHub's security tab and pull requests, so the value assumes GitHub is your forge. The CodeQL CLI itself can run elsewhere, but only within its licence: open-source codebases, and not in an automated CI or CD system without a commercial licence. SonarQube has no such tie and integrates with GitHub, GitLab, Bitbucket and Azure DevOps equally.