diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9411551..0888bd5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,11 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          # Full history so SonarCloud can attribute new code / blame accurately.
+          fetch-depth: 0
+          # No later step needs authenticated git; keep the token out of .git/config.
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -29,10 +34,7 @@ jobs:
       - name: Type check
         run: bun run type-check
 
-      - name: Run tests
-        run: bun test
-
-      - name: Generate coverage report
+      - name: Run tests with coverage
         run: bun run test:coverage
 
       - name: Upload coverage reports to Codecov
@@ -42,6 +44,13 @@ jobs:
           files: ./coverage/lcov.info
         continue-on-error: true
 
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
+        continue-on-error: true
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: https://sonarcloud.io
+
       - name: Build
         run: bun run build
 
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..643aa63
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,16 @@
+sonar.organization=pleaseai
+sonar.projectKey=pleaseai_cli-toolkit
+
+# Analyze source; tests live under test/
+sonar.sources=src
+sonar.tests=test
+sonar.test.inclusions=test/**/*.test.ts
+
+# Enable type-aware TypeScript analysis
+sonar.typescript.tsconfigPath=tsconfig.json
+
+# Coverage produced by `bun test --coverage` (see bunfig.toml)
+sonar.javascript.lcov.reportPaths=coverage/lcov.info
+
+# Build output and coverage artifacts are not source
+sonar.exclusions=dist/**,coverage/**