qa-code-quality
Production code quality: 5 skills (sonarqube-maintainability-gate, codeclimate-config, lizard-complexity, madge-deps, knip-dead-code) and 1 agent (code-quality-critic). Production-only scope; test-code hygiene is owned by qa-test-review.
Install this plugin
/plugin install qa-code-quality@testland-qaPart of role bundles: qa-role-sdet, qa-role-leadership
qa-code-quality
Production code quality wrappers + a synthesizing critic. Five skills covering SonarQube (Reliability+Maintainability lens - qa-sast covers the Security lens), Qlty (formerly Code Climate), Lizard (cyclomatic complexity, language-agnostic), Madge (JS/TS module graph + circular deps), and Knip (dead code) - plus a critic agent (code-quality-critic) that dedupes and prioritizes findings across all five tools.
Scoped to production code only. Test-code hygiene (AAA structure, assertion quality, mocking anti-patterns) is owned by qa-test-review. Each skill includes the production-only scoping config (e.g., sonar.exclusions, lizard -x"./tests/*", Madge excludeRegExp).
Components
| Type | Name | Description |
|---|---|---|
| Skill | sonarqube-maintainability-gate | SonarQube/SonarCloud Reliability + Maintainability lens; Sonar Way Quality Gate enforcement; PR decoration |
| Skill | codeclimate-config | Both legacy .codeclimate.yml (Code Climate Velocity / GitHub App) and new .qlty/qlty.toml (Qlty CLI) |
| Skill | lizard-complexity | Per-function CCN + NLOC + parameter-count thresholds; 30+ languages; CSV/XML/HTML output |
| Skill | madge-deps | JS/TS module-graph analysis; circular-dep detection; orphan/leaf finding; SVG visualization |
| Skill | knip-dead-code | Unused files / dependencies / exports / types / enum members; framework plugins (Next.js, Remix, Astro, etc.) |
| Agent | code-quality-critic | Adversarial reviewer that dedupes overlapping findings across all 5 tools; net-new-vs-inherited classification; refuses to ✅ on net debt increase |
Install
/plugin marketplace add testland/qa
/plugin install qa-code-quality@testland-qaSkills
codeclimate-config
Configure Code Climate Quality (now Qlty) for repository-wide quality gates - duplication, complexity, similar-code, exclude_patterns. Covers both legacy `.codeclimate.yml` (Code Climate Velocity / GitHub integration) and the new `.qlty/qlty.toml` per the Qlty platform migration. Use when a repo needs duplication and complexity thresholds enforced on PRs, or when an existing `.codeclimate.yml` must be migrated to Qlty without losing its plugin and exclude settings.
knip-dead-code
Run Knip against a JS/TS project to detect unused files, unused dependencies, unused exports, and unused class/enum members. Scoped to production code; tests are entry-point-aware via Knip's framework plugins. Use after a feature or route is deleted and the project still compiles, or when `package.json` has accumulated dependencies nobody can account for.
lizard-complexity
Run Lizard against production source to enforce per-function cyclomatic complexity (CCN), NLOC, and parameter-count thresholds - language-agnostic (30+ languages). Scoped to production code via `-x"./tests/*"`; test complexity is reviewed separately. Use when a codebase spans several languages and needs one complexity gate across all of them, or when a function has grown unreviewable and the team wants a numeric threshold in CI.
madge-deps
Run Madge against a JS/TS production source tree to detect circular dependencies, find orphan modules, and visualize the module graph. Scoped to production code via `excludeRegExp` for test files. Use when a build compiles but throws `Cannot read property X of undefined` on a module that is clearly imported, or when a repo needs a CI gate that blocks new import cycles.
sonarqube-maintainability-gate
Run SonarQube/SonarCloud against production code to surface Code Smells, Bugs, and Maintainability ratings - the maintainability lens rather than the security lens. Production-only scope via sonar.exclusions; test code is reviewed separately. Use when a team wants maintainability and technical-debt ratings gating PRs, or when an existing SonarQube project reports numbers nobody has tied to a quality gate.