Which Code Issues Actually Matter? | Prioritizing SonarQube Findings
summary
CoreStory and Sonar integrate via MCP so an AI agent pulls Sonar findings and CoreStory architecture context to decide what to fix. Demo shows an agent scanning a Django project with 132 vulnerabilities, 1,300 hotspots, ~2,800 issues, isolating 158 blockers and auto-triaging 132 as test vectors, deprioritizing 25, and flagging one breaking-date-formatter as a true blocker. The closed loop writes fixes, resubmits to Sonar, and yields claimed savings of ~850 hours (~$64k) per project per year.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:17The Triage Gap: Too Many Findings, Not Enough Context
- 1:01Why Severity and Business Impact Are Not the Same
- 2:05How Core Story and SonarQube Work Together via MCP
- 2:54The Investigate, Triage, and Build Loop
- 4:10Demo Setup: Analyzing a Real Django Codebase
- 4:42Reviewing Project Metrics and Blocker Findings
- 5:40Using Architecture Context to Dismiss Test Password Noise
- 6:29Identifying a Real Blocker That Should Not Be Fixed
- 7:40Writing Code with Core Story and SonarQube Validation
- 8:18Automated Triage with Documented Rationale
- 9:35ROI: Time Saved, Cost Savings, Backlog Coverage
- 11:07Why It Matters Now and How Teams Can Start
related talks
45mTechnical Debt Prioritisation - Identifying & Fixing Highest ROI Issues
42mThe top 5 JavaScript issues in all our codebases
06mKeynote: Thrive with Clean Code
46mCode Quality in the AI era, needed more than ever
32mCode Security Reinvented: Navigating the Era of AI
30mAn Extensible Feature-Oriented Approach for Fine-Grained Code Quality Analysis
15mCan LLMs generate Enterprise Quality Code?
49mClean Code in the AI era