How static code analysis works

Question

I am new to SonarQube. I have few questions on SonarQube-DevOps implementation:

1. When to use SonarQube in DevOps. Before build gets started or after build?
2. Will SonarQube Static Code Analysis be performed on Java files or on class files?

Answer 1

1. Run the scan after the build. Most of the SonarAnalyzers (the language engines inside the plugins) presume they're dealing with compilable code.
2. The SonarAnalyzer for Java requires both the .java files and the .class files for a full and thorough analysis.