Code Quality
Xygeni Code Quality analyses your source code for maintainability and reliability defects — code smells, complexity violations, dead code, duplication, and patterns that cause runtime failures — and surfaces them in a dedicated Quality section in the web platform, separate from security findings.
Quality is delivered as its own scanner (xygeni quality) that shares the static-analysis engine with SAST (parsers, AST, file discovery) but maintains its own rule catalog focused on quality, not security.
Quality scanner
Run a quality scan with the dedicated command:
xygeni quality -d <directory> [options]The alias xygeni code-quality is also accepted.
The scanner shares its option model with xygeni sast. The most common options are:
-d, --dir <directory>
Directory to analyse. Defaults to the current working directory.
-n, --name <name>
Project name to report under.
--upload
Upload results to the Xygeni platform. By default, results are not uploaded.
--detectors <list>
Comma-separated list of detector IDs to run, a severity (critical, high, low, info), or all. When a severity is given, that severity and any higher ones are included.
--skip-detectors <list>
Inverse of --detectors.
-i, --include <patterns>
Glob patterns of files to include.
-e, --exclude <patterns>
Glob patterns of files to exclude.
-o, --output <file>
Output file path. Defaults to stdout.
-f, --format <format>
Output format.
--fail-on <severity>
Exit non-zero if findings of the given severity (or higher) are produced. Useful as a CI/CD gate.
--baseline <file>
Compare against a baseline report and only return new findings.
For the full option list run:
Examples
Run a quality scan on the current directory and upload the results:
Export critical findings to JSON:
Run quality alongside a SAST scan
The SAST scanner accepts an --include-quality flag that runs the quality rules in the same pass. The SAST and quality rules share the parser stage, so this is more efficient than running xygeni sast and xygeni quality back to back when you want both.
The scan produces both a SAST report and a separate quality report. SAST and quality findings remain on their own report files and on their own dashboard sections — --include-quality only changes how the scan is executed, not how the results are surfaced.
Upload a previously generated quality report
Quality results are normally sent to the platform during the scan with --upload. When the scan runs where there is no connectivity to Xygeni (an air-gapped enclave, or a CI runner without network egress), save the report and upload it later with report-upload:
The findings land in the Quality section exactly like a native quality scan — same triage, policy, baseline, and remediation behaviour — and never in the SAST / All Risks views.
report-upload recognises the report from its standard file name depsdoctor-quality.json. If the file was renamed (for example via --output), pass the format explicitly so it is not mistaken for a SAST report (both share the same report shape):
Uploading a quality report requires the Code Quality entitlement, the same as running the scan.
Quality findings in the web platform
Quality findings are uploaded to the Xygeni platform alongside any other scan output and are displayed in a dedicated Quality section of the dashboard, separate from SAST and the rest of the security risks. Filtering, slide-out detail, baselines, and reports work the same way as for the other risk tables.
Related
SAST Scanner — security-focused static analysis. Quality and SAST share the engine but ship as independent scan commands and rule catalogs.
Xygeni CLI Configuration options — configuration files (
xygeni.yml,xygeni.<command>.yml) and--conf-optionoverrides.
Last updated