一句话：通过前瞻性队列研究，评估 SonarQube Cloud 质量门定制配置对安全、可靠性和可维护性的影响。
静态代码分析工具常提供预定义配置，项目方可按目标定制质量门等设置，但其对代码质量属性的因果影响尚不明确。本文采用前瞻性队列研究，持续追踪 230 个开源 GitHub 项目，记录其 SonarQube Cloud 质量门配置在定制与预定义之间的转换，并比较二者对安全性、可靠性和可维护性的影响。结果显示，仅较宽松配置下的安全性出现显著效应，提示当要求被认为可达时，开发者更可能修复安全问题；可靠性和可维护性未发现显著影响，作者推测这可能因为二者被视为不如安全性紧迫或必要。
Static Code Analysis (SCA) tools are used to detect issues and enforce code quality standards in software projects. SCA tools like SonarQube Cloud provide predefined configurations that project owners can customize depending on the goal of the project at hand. One such configuration is the quality gate, which defines the set of conditions that source code must satisfy to pass automated quality checks during software development. This paper investigates the impact of customizing SonarQube Cloud quality gates on security, reliability, and maintainability. We employ a prospective cohort study design to explore causal relationships using observational data. We track 230 open-source GitHub projects forward in time, monitoring transitions in configurations to ensure consistent adherence to either customized or predefined ones. A significant effect was observed only for security under less strict configurations, suggesting that developers could be more motivated to fix security issues when the requirements are perceived as attainable. For reliability and maintainability customizations, we speculate that the lack of impact may stem from these quality attributes being perceived as less essential or pressing compared to security.
@inproceedings{paperbot12366,
title = {On the Effects of Customized Configurations of Static Code Analysis Tools: A Prospective Cohort Study of SonarQube Cloud},
author = {Sabato Nocera and Sira Vegas and Giuseppe Scanniello},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834408}
}