Hi @AEMWizard ,
As per previous cases raised with Adobe support, what we have got to know is that only Java code is scanned. In case you are looking for frontend as well, then you need to setup the Sonar scans on your own SonarQube server or submit a feature request.
Flow would be:
Sonar scans on your custom CICD job -> Implement gating based on metrics, if any -> Push to Adobe to trigger Cloud manager deployment.
You can check Sonar rules here.
Code Quality Testing | Adobe Experience Manager
Thanks,
Ram