SonarQube is pretty useless for quality control unless your process is already broken, in which case you should probably fix your process.

I once worked at a company where the powers-that-be decided to add SonarQube with max settings to the pipeline for a large C++ code base. It produced no output so IT thought the install was broken. They eventually figured out that it was actually working perfectly but that it never found any issues across the entire code base ever. We got that for free with sensible build configurations long before it got to SonarQube.

TDD and tools are not a substitute for competent process. I’ve seen plenty of TDD produce objectively poor quality code bases.