diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 477b72c..c7eb3ed 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -3,6 +3,15 @@ on:
   push:
     branches:
       - '**'
+  workflow_call:
+    secrets:
+      SONAR_HOST_URL:
+        description: "Sonar host"
+        required: true
+      SONAR_TOKEN:
+        description: "SonarQube token"
+        required: true      
+  workflow_dispatch:
 
 jobs:
   build:
@@ -17,4 +26,20 @@ jobs:
 
       - run: npm i
       - run: npm run build
-      - run: npm test
+
+      - name: Test
+        run: npm test
+
+      - name: Store reporting artifacts for Sonar
+        uses: actions/upload-artifact@v3
+        with:
+          name: sonar-report-artifacts
+          path: |
+            coverage/lcov.info
+
+  report:
+    needs: [build]
+    uses: ./.github/workflows/sonar.yml
+    secrets:
+      SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 0000000..cc8cade
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,47 @@
+name: sonar
+
+on:
+  workflow_call:
+    secrets:
+      SONAR_HOST_URL:
+        description: "Sonar host"
+        required: true    
+      SONAR_TOKEN:
+        description: "SonarQube token"
+        required: true
+
+env:
+  LANG: "en_US.UTF-8"
+  LANGUAGE: "en_US:en"
+  LC_ALL: "en_US.UTF-8"
+
+jobs:  
+  sonarqube:
+    name: Sonar analysis
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Download reporting artifacts for Sonar
+        uses: actions/download-artifact@v3
+        with:
+          name: sonar-report-artifacts
+
+      - name: SonarQube Scan
+        uses: sonarsource/sonarqube-scan-action@master
+        with:
+          args:
+            -Dsonar.verbose=true
+            # TODO: pass in the latest release tag name
+            # -Dsonar.projectVersion=${{ xxx }}
+        env:        
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      
+      - name: Remove reporting artifacts for Sonar
+        uses: geekyeggo/delete-artifact@v2
+        with:
+          name: sonar-report-artifacts
+          failOnError: false
diff --git a/.gitignore b/.gitignore
index 1a11050..f701253 100755
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,7 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+
+.scannerwork/
+coverage/
+test-report.xml
diff --git a/package-lock.json b/package-lock.json
index 61c2229..3f82884 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "opticks",
-  "version": "4.0.2",
+  "version": "4.1.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "opticks",
-      "version": "4.0.2",
+      "version": "4.1.1",
       "license": "ISC",
       "devDependencies": {
         "@changesets/cli": "^2.26.0",
diff --git a/package.json b/package.json
index f72cfa9..7a1adf9 100755
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "jscodeshift": "jscodeshift",
     "prepare": "npm run build",
     "release": "npm run prepare && npx changeset publish",
-    "test": "jest src",
+    "test": "jest src --coverage",
     "test:watch": "jest --watch src",
     "changeset": "npx changeset"
   },
@@ -54,4 +54,4 @@
     "tsup": "^6.5.0",
     "typescript": "^4.9.4"
   }
-}
+}
\ No newline at end of file
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..9b826c0
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,23 @@
+# Must be unique in a given SonarQube instance
+sonar.projectKey=opticks
+
+# This is the name and version displayed in the SonarQube UI.
+sonar.projectName=Opticks - Toggle Library
+sonar.projectVersion=1.0
+ 
+# Path is relative to the sonar-project.properties file.
+sonar.sources=src
+sonar.tests=src
+ 
+# Encoding of the source code. Default is default system encoding
+sonar.sourceEncoding=UTF-8
+
+sonar.exclusions=**/*.test.*
+sonar.test.inclusions=**/*.test.tsx,**/*.test.ts
+
+sonar.javascript.coveragePlugin=lcov
+
+# Downloading the artifact does not recreate the directory structure
+# so we must consume the lcov.info from the root
+# Running locally? use coverage/lcov.info instead
+sonar.javascript.lcov.reportPaths=lcov.info