diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 19a8ad7..c8b671a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -11,9 +11,9 @@ stages:
 
 # build jobs
 build-node:
+  stage: build
   extends:
     - .build-node
-  stage: build
 
   script:
     - make ci
@@ -56,8 +56,8 @@ build-image-alpine-tag:
     IMAGE_ARCH: alpine
 
 build-image-stretch-branch:
-  extends: [.build-docker]
   stage: image
+  extends: [.build-docker]
   except:
     - tags
   script:
@@ -66,9 +66,9 @@ build-image-stretch-branch:
     IMAGE_ARCH: stretch
 
 build-image-stretch-tag:
+  stage: image
   extends:
     - .build-docker
-  stage: image
   only:
     - tags
   script:
@@ -78,11 +78,10 @@ build-image-stretch-tag:
 
 # publish jobs
 publish-npm:
+  stage: publish
   extends:
     - .build-node
-  stage: publish
-  only:
-    - tags
+    - .deploy-tags
 
   dependencies:
     - build-node
@@ -120,24 +119,41 @@ codecov-success:
     - make upload-codecov
 
 github-pending:
+  stage: status-pre
   extends:
     - .build-curl
-  stage: status-pre
   script:
     - ./scripts/github-status.sh pending
 
 github-failure:
+  stage: status-post
   extends:
     - .build-curl
-  stage: status-post
   when: on_failure
   script:
     - ./scripts/github-status.sh failure
 
 github-success:
+  stage: status-post
   extends:
     - .build-curl
-  stage: status-post
   when: on_success
   script:
     - ./scripts/github-status.sh success
+
+sonar-success:
+  stage: status-post
+  extends:
+    - .build-sonar
+
+  when: on_success
+  script:
+    - make node_modules
+    - sonar-scanner
+        -Dsonar.projectKey=ssube_rollup-template
+        -Dsonar.projectVersion=${CI_COMMIT_REF_SLUG}
+        -Dsonar.organization=ssube-github
+        -Dsonar.sources=src/,test/
+        -Dsonar.host.url=https://sonarcloud.io
+        -Dsonar.login=${SONAR_SECRET}
+        -Dsonar.typescript.lcov.reportPaths=out/coverage/lcov.info