Code scanning features comparison between github advanced security vs sonarqube

[rpradanaquadrant]

Select Topic Area

Question

Body

Hello everyone,
I am currently looking for a code scanning tools that will be placed in my ci/cd pipeline and executed upon the app release, with the purpose of:

1. scan any code that is insecure/vulnerable
2. scan any code that is inefficient in terms of performance
   upon service selection, im trying to compare between sonarqube and github advanced security on their pros and cons for the purpose mentioned above. would there be any reference to help for this?

also for github advanced security, is it possible to purchase only the code scanning feature without having to subscribe to github enterprise? thank you very much

[igbins09]

You have to subscribe to GitHub Enterprise to use the code scanning feature

[bbqchickenrobot]

Is this true even for public repositories?

[igbins09]

Is this true even for public repositories?

It's available for public repositories w/o an Enterprise subscription.