Archon and SonarQube: security gates for AI coding

The presenter explains how he combines Archon, his open source workflow harness, with SonarQube to check AI-generated code before handing a pull request back for review. His central argument is that a coding assistant's security review needs a repeatable scan and an enforced pass condition.

The workflow starts with a GitHub issue, classifies it as a bug or feature, then investigates or plans before implementation. In the detailed example, it opens a pull request before a Bash script calls the SonarQube API. The report goes to an AI agent for fixes, and another scan checks whether the results meet the gate's threshold. The workflow readies the pull request only after that check passes.

The demonstration reports three issues, including a potentially hard-coded password. After the agent's fixes, the dashboard shows a security rating of A and no issues. The presenter also discusses vulnerable dependencies and why another review agent can miss problems that the implementation agent overlooked.

The guarantee concerns following the checking process, not detecting every vulnerability. This is a high-level workflow tutorial using SonarQube Cloud; it does not establish an offline or fully self-hosted setup. The presenter discloses a partnership with Sonar.