It could either run on PRs such as here: https://github.com/apache/jackrabbit-filevault/pull/167#issuecomment-924846894

Or on our codebase in general. There, we would need a strategy to tackle issues and not simply get reports about them.

Sonarqube supports Bitbucket Server: https://docs.sonarqube.org/latest/analysis/bitbucket-integration/

Unliked SonarCloud, Sonarqube can be run locally: https://docs.sonarqube.org/latest/setup/get-started-2-minutes/

We need to set it up on a developer's machine and get a feel for what’s possible with it. Sonarqube offers standard quality checks. mgeljic can also help when it comes to enforcing simple policies such as Lombok usage.

Only in a second step should we look into writing custom checks, possibly across modules (e.g. code in pages should have test coverage in CE as well).