Your organization has 15 teams using different languages (Java, Python, TypeScript, Go). How do you manage Quality Profiles and custom rule sets in SonarQube to provide team-appropriate standards while maintaining organization-wide baselines?
Quick Answer
Create a hierarchy of Quality Profiles: an organization-wide parent profile with mandatory rules (security, critical bugs), language-specific child profiles that inherit and add language idioms, and team-specific profiles for additional strict rules. Use profile inheritance so changes to the parent cascade automatically.
Detailed Answer
Quality Profile Architecture
A Quality Profile is a named set of activated rules for a specific language with configured severities and parameters. Each project is assigned one profile per language. Profiles support inheritance: a child profile activates all rules from its parent plus its own additions. This enables layered governance: organization-wide rules at the top, team-specific additions at the bottom.
Design Pattern
Create three layers: (1) 'Acme-Base-Java' as the parent with security rules (all OWASP categories), critical bug detection, and basic maintainability rules. (2) 'Acme-Backend-Java' inherits from Base, adds API-specific rules (REST security, serialization safety, connection pool management). (3) 'Acme-Payment-Java' inherits from Backend, adds stricter crypto rules, PCI-related patterns, and zero-tolerance for security hotspots. Each team uses the profile appropriate to their service's sensitivity level.
Rule Configuration
Rules can be tuned per profile: change severity (minor to critical for payment team's crypto rules), adjust parameters (cognitive complexity threshold from 25 to 15 for critical services), or add exclusions (generated code patterns). Document WHY each customization exists. Use the 'compare' API to diff profiles and ensure consistency.
Governance
Only the quality engineering team (not individual developers) should modify the parent profile - changes cascade to all child profiles. Use the changelog API to audit who changed what. Before modifying a parent profile rule, use the 'projects' API to see how many projects will be affected. Run a dry analysis with the modified profile before activating it organization-wide.
Code Example
# Create parent profile
curl -u admin:$TOKEN -X POST \
"https://sonar.company.com/api/qualityprofiles/create" \
-d "name=Acme-Base-Java&language=java"
# Set parent-child relationship
curl -u admin:$TOKEN -X POST \
"https://sonar.company.com/api/qualityprofiles/change_parent" \
-d "qualityProfile=Acme-Backend-Java&parentQualityProfile=Acme-Base-Java&language=java"
# Activate rules in bulk (e.g., all OWASP rules)
curl -u admin:$TOKEN -X POST \
"https://sonar.company.com/api/qualityprofiles/activate_rules" \
-d "targetKey=AXk1_profile_key&tags=owasp-top10&activation=true"
# Activate specific rule with custom parameters
curl -u admin:$TOKEN -X POST \
"https://sonar.company.com/api/qualityprofiles/activate_rule" \
-d "key=AXk1_profile_key&rule=java:S3776&severity=CRITICAL¶ms=Threshold=15"
# S3776 = Cognitive Complexity - lowered threshold from 25 to 15
# Compare two profiles
curl -u admin:$TOKEN \
"https://sonar.company.com/api/qualityprofiles/compare?leftKey=acme-base&rightKey=acme-payment" \
| jq '{only_left: .left.length, only_right: .right.length, modified: .modified.length}'
# Assign profile to project
curl -u admin:$TOKEN -X POST \
"https://sonar.company.com/api/qualityprofiles/add_project" \
-d "qualityProfile=Acme-Payment-Java&project=payment-service&language=java"
# Export profile for backup/version control
curl -u admin:$TOKEN \
"https://sonar.company.com/api/qualityprofiles/backup?qualityProfile=Acme-Base-Java&language=java" \
> profiles/acme-base-java.xml
# Profile hierarchy example:
# Acme-Base-Java (450 rules)
# ├── Acme-Backend-Java (+30 rules = 480 total)
# │ ├── Acme-Payment-Java (+20 rules = 500 total)
# │ └── Acme-API-Java (+15 rules = 495 total)
# └── Acme-Library-Java (+10 rules = 460 total)
# Audit: who changed the profile recently
curl -u admin:$TOKEN \
"https://sonar.company.com/api/qualityprofiles/changelog?qualityProfile=Acme-Base-Java&language=java&ps=10" \
| jq '.events[] | {date: .date, action: .action, rule: .ruleKey, author: .authorName}'
# Impact analysis before changing parent profile
curl -u admin:$TOKEN \
"https://sonar.company.com/api/qualityprofiles/projects?key=acme-base-java" \
| jq '.results | length'
# Returns: 45 (this many projects will be affected by parent changes)
# Profile comparison in CI (detect unauthorized changes)
#!/bin/bash
curl -s -u admin:$TOKEN \
"https://sonar.company.com/api/qualityprofiles/export?qualityProfile=Acme-Base-Java&language=java" \
| md5sum > /tmp/current.md5
diff profiles/acme-base-java.md5 /tmp/current.md5 || \
echo "ALERT: Profile was modified outside of change management!"Interview Tip
The inheritance model is the key concept. Show you understand why: changes to security rules in the parent automatically cascade to all teams without manual updates. Mention the impact analysis step (checking how many projects are affected) before modifying parent profiles - this shows operational maturity.