Gatetrail

Quality gates and code findings as Jira tickets that keep themselves up to date.

Start without touching CI: install the app, bind a SonarQube™ project on the admin page and add a webhook in SonarQube. From the next analysis on, a failed quality gate becomes a Jira ticket that stays up to date while the gate is red and closes itself when it passes.

When your DevOps team adds the relay to the pipeline, findings follow — one ticket per rule instead of one per code smell, updated, closed and reopened with every analysis, with fix deadlines per severity and risk decisions that flow back to SonarQube with date, reason and the Jira ticket.

Read the setup guide See pricing

Licensing and billing run through the Atlassian Marketplace. Questions, or a pilot for your business: write to support@gatetrail.com. Built on Atlassian Forge. Your SonarQube token stays with you: it is used only by the relay in your CI to call your SonarQube and is never sent to the app or to us.

What it does

Quality gate tickets, no CI change

Set up in Jira and SonarQube alone: a failed quality gate opens a ticket per project and branch with the failed conditions and a link to SonarQube. It is updated while the gate stays red, closes itself when it passes and reopens if it fails again.

Finding tickets that keep themselves up to date

With the relay in your CI, every analysis updates the tickets it concerns: new findings are added, fixed ones disappear, and a ticket closes itself once its rule is clean — and reopens if the findings come back.

Deadlines and risk decisions

Set days to fix per severity and get a due date on every finding ticket, searchable with JQL and flagged when overdue. Approvers accept a risk or mark a false positive right in Jira, with a mandatory reason — logged for audits and written back to SonarQube.

Built on Atlassian Forge

The app runs on Atlassian's platform, with no server of ours in between and no egress permissions. The SonarQube webhook and the relay in your CI both send outbound, so your SonarQube needs no public access and your token stays with you. Tested with SonarQube Community Build 26.9.

How it works

Step 1: quality gate tickets, for the Jira admin

Install and bindInstall Gatetrail, generate the webhook secret and bind a SonarQube project to a Jira project on the admin page.
Webhook in SonarQubeAdd the app's URL and secret as a webhook of the project. Your SonarQube sends each quality gate result, signed, outbound.
Gatetrail on AtlassianVerifies each result and opens, updates, closes and reopens the quality gate ticket.

No change to your CI pipeline and no SonarQube token in Jira.

Step 2: finding tickets, for the DevOps team

Relay in your CIAfter each scan, reads open findings from your SonarQube and pushes them, signed, outbound.
Gatetrail on AtlassianCreates, updates, reopens and closes one ticket per rule and keeps the project overview.
JiraTeams plan the work against deadlines; approvers record risk decisions that go back to SonarQube.

The relay is a single file that needs only Node.js, published as @gatetrail/relay under the MIT license.

Features

With the webhook alone:

With the relay in your CI, in addition:

Pricing

For businesses only. Per Jira user tier, billed by Atlassian on our behalf as our commercial agent. Free for up to 10 users; from 11 users every user is billed, at USD 0.79 per user up to 100 users, 0.50 from 101 to 250 and 0.18 from 251 to 1,000. Annual billing costs ten times the monthly price. Terms: Atlassian's standard Marketplace End User Agreement, unchanged, with our short Provider-Specific Terms shown on the Marketplace listing.

Jira usersup to 1025501002005001,000
USD / monthfree19.7539.5079129199289

Prices in USD, excluding applicable taxes; the prices on the Atlassian Marketplace listing are binding.

Requirements