SonarCloud vs Polaris Research

[morganzellers]

• Why even look at Polaris?
  • WWT Has used Polaris before internally
  • May have reason to modify SonarCloud account anyways, so we looked at Polaris as a possible alternative
  • Our SonarCloud scan was failing anyways
• Findings
  • It was easy to get Polaris up and running with a basic scan
  • Full scan results available only via WWT internal SSO access
  • Point of contact in WWT's Security organization mentioned Polaris is in it's early stages and there are still lots of unknowns
• Unknowns
  • We found Github Actions for Polaris, but we didn't feel they would add enough visibility of the full scan results.
  • Polaris seems to be oriented more towards security scanning than general code-quality scanning
  • WWT has not used Polaris on a Swift project before

Conclusion

We decided to stick with SonarCloud over migrating to Polaris at time. One of the major reasons, is that access to the full scan would be locked behind WWT SSO. An external contributor may have the scan fail but no way of knowing why.