Skills Guide

Full local CI + SonarQube refresh

VerifiedCaution

Run the local CI pipeline (ruff, bandit, pytest, sonar-scanner) and refresh SonarQube.

Download and use
Sby Skills Guide Bot
DevOpsIntermediate
7/22/2026
Claude Code
#ci-pipeline#sonarqube#static-analysis#pytest#code-quality

Recommended for

Backend developerClaude CodeDevOps engineerGit automation

Automated summary

Runs the local CI chain (ruff, bandit, pytest, sonar-scanner) and refreshes SonarQube findings through the MCP server.

Strengths

  • Ordered single bash chain that clears then regenerates reports before the scanner uploads them.
  • `test -s reports/coverage.xml` guard blocks the upload on an empty coverage report, avoiding the 0% trap.
  • `--exit-zero` on ruff and bandit guarantees JSON reports get written while pytest stays the hard gate.
  • Explicit anti-patterns: never run sonar-scanner alone and never skip the pipeline to hide findings.

Limitations

  • Assumes uv, sonar-scanner, and the SonarQube MCP server are installed and configured.
  • Unix-specific chained bash (rm -f, test -s, tee) that does not run as-is on Windows.
  • Report paths and config (pyproject.toml) are hardcoded for this specific Python project.
When to use it

Use it before opening a pull request or whenever SonarQube findings look stale.

When not to use it

Avoid it on non-Python projects or environments lacking sonar-scanner/uv, or for quick iterations where only tests matter.

Security analysis

Caution
Quality score90/100

The skill is a legitimate local CI workflow with scoped cleanup and standard dev tools. It does not contain obfuscated or clearly malicious actions, secret exfiltration, or broad destructive commands. However, it executes shell commands, installs dependencies, auto-fixes source files, and uploads analysis data to SonarQube, so it warrants caution rather than being classified as safe.

Findings
  • •Runs a shell pipeline that syncs dependencies from the network via `uv sync`.
  • •Uses `rm -f` to delete files under `reports/`; deletions are scoped but still destructive.
  • •Runs `ruff check --fix`, which can automatically modify source files.
  • •Invokes `sonar-scanner`, which uploads analysis data to a configured SonarQube server and may use credentials from the environment.
How this analysis is made

Examples

Pre-PR full CI
Run /ci to refresh SonarQube and make sure ruff, bandit, and pytest all pass before I open my PR.
Stale SonarQube findings
The SonarQube findings look out of date — run the full local CI pipeline and pull the new issues afterwards.
Coverage still 0%
Coverage on SonarQube flipped back to 0%; rerun the whole pipeline including the coverage.xml guard and scanner.

name: ci description: Run the local CI pipeline (ruff, bandit, pytest, sonar-scanner) and refresh SonarQube. disable-model-invocation: true

/ci — Full local CI + SonarQube refresh

Run this before opening a PR, or whenever the mcp__sonarqube__* findings look stale. The scanner uploads the JSON reports that ruff, bandit, and pytest produce, so those have to run first.

Steps

  1. Drop stale reports so the scanner never uploads yesterday's data.
  2. Sync dev and test deps.
  3. Run ruff with a JSON report (exit-zero so the chain continues even if there are findings).
  4. Run bandit with a JSON report (exit-zero, same reason).
  5. Run the full pytest suite (must pass; pytest-cov writes reports/coverage.xml).
  6. Assert reports/coverage.xml exists and is non-empty. This guards against the "0% coverage" trap where sonar-scanner silently ships an empty report.
  7. Invoke sonar-scanner, tee the log to reports/sonar-scan.log.
rm -f reports/coverage.xml reports/lcov.info reports/ruff_report.json reports/bandit_report.json && \
  uv sync --group dev --group test && \
  uv run ruff check --fix --output-format=json --output-file=reports/ruff_report.json --exit-zero . && \
  uv run bandit --configfile pyproject.toml --recursive --format json --output reports/bandit_report.json --exit-zero . && \
  uv run pytest && \
  test -s reports/coverage.xml && \
  sonar-scanner 2>&1 | tee reports/sonar-scan.log

After the scanner finishes, use mcp__sonarqube__search_sonar_issues_in_projects to pull new findings for review.

Notes

  • pytest is the gate: if tests fail, the chain stops before the scanner runs.
  • The test -s reports/coverage.xml guard is the second gate. If coverage.xml is missing or empty the chain stops before upload, so the SonarCloud dashboard never flips back to 0%.
  • ruff and bandit are set to --exit-zero on purpose so report JSON is always written.
  • Do not skip this pipeline to make findings disappear. If something is flaky, fix the flake.
  • Do not run sonar-scanner on its own. Without a fresh reports/coverage.xml it uploads an analysis with 0% coverage and overwrites the last good one.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/full-local-ci-sonarqube-refresh-mrwakdfy/download' --output '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md.part' && mv '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md.part' '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md' && test -s '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/ci' && cp -R '.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy' '.claude/skills/ci'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy'

openskills read 'full-local-ci-sonarqube-refresh-mrwakdfy'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/full-local-ci-sonarqube-refresh-mrwakdfy/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

Configure a Chat Channel with SecretRefs

DevOps

Set up chat channels using non-interactive commands, with secrets only as SecretRefs. Covers gather, mutate, repair, and prove steps for reliable delivery.

Claude CodeCodexintermediateSafe 387,940
Skills Guide Bot

Investigate ClickHouse CI Failures

DevOps

Investigate a ClickHouse CI failure end-to-end from a PR or S3 report URL. Fetches failed tests, classifies flaky vs real regression, and checks for existing issues/fixes.

Claude CodeadvancedSafe 49,516
Skills Guide Bot

Ansible PR Review

DevOps

Reviews an Ansible PR following the project's standardized process, including changelog checks, test coverage validation, and feedback tracking.

Claude CodeintermediateSafe 70,491
Skills Guide Bot