SonarQube and Java - Spazio IT · SonarQube and Jenkins Running SonarQube Analyses: –Sonar-Runner...

© 2016 Spazio IT - Soluzioni Informatiche s.a.s.

1

Spazio IT

SonarQube

And

Java

October 2016

SPAZIO IT –

SonarQube and Java

Maurizio Martignano

Spazio IT – Soluzioni Informatiche s.a.s

Via Manzoni 40

46030 San Giorgio di Mantova, Mantova

http://www.spazioit.com


2

Agenda

SonarQube

Tools

IDEs

Continuous Integration

Hands on the Platform

Processes

October 2016


3

SonarQube

Code Quality Platform

October 2016


4

SonarQube – What is it?

SonarQube is an open source Web Application (http://www.sonarqube.org) which

– Takes in input a set of source code files and a set of analyses results (produced by external tools).

– Stores both sources and results in a database.

– Makes available the gathered information via a dynamic website where the results are shown in the context of the code itself.

October 2016

http://www.sonarqube.org/


5

SonarQube – What is it?

October 2016

Source Code

Files

SonarQube

Database

SonarQube

Engine

Analyses

Results


6

SonarQube / Plugins / Sensors

October 2016

SonarQube

Plugin-Me.g. Java

Plugin-Ie.g. C/C++

Plugin-1e.g. Ada

Sensor-Je.g. PC-Lint

Sensor-Me.g. GCOV

Sensor-1eg. CppCheck

Post-Processinge.g. CPD, Decorators

Pre-Processinge.g. scanning

and parsing


7

SonarQube – There’s more

Analyses on the same code base can be performed at different moments in time and SonarQube keeps track of the changes/evolution.

The problems found during analyses (a.k.a. issues) can be managed directly from within the system itself, e.g.

– Identifying false positives

– Assigning issues to developers

– Checking their status (if they have been solved)

– …

October 2016


8

SonarQube - Screenshots

October 2016

http://sonarsrv.spazioit.com/



9


October 2016




10


October 2016




11


October 2016




12

SonarQube = Tools (+ Platform)

October 2016


13

Tools Classification

October 2016

Tools

Dynamic Analysis

Static Analysis

Testing

(U, I, A)

Coverage

Real Time Analysis

Standards / Guidelines

Bugs Finding

Patterns Matching

SD Stuff, e.g.:

Model Checking,

Abstract

Interpretation

Metrics Quality Models (?)

Education / Learning


14

Tools: Java

October 2016

Tools

Dynamic Analysis

Static Analysis

JUnit

Cobertura, Clover

ThreadSafe

Checkstyle

SonarQube JavaPlugin

FindBugs, PMD

Patterns Matching

Opal, Soot,

JPF,

?

SonarQube JavaPluginSonarQube

SqualePlugin

Education / Learning


15

SonarQube Integration with IDEs

October 2016


16

SonarQube and Visual Studio

(C/C++)

October 2016


17

SonarQube and Eclipse (Java)

October 2016


18

SonarQube and Eclipse (C/C++)

October 2016


19

SonarQube and Oracle

JDeveloper (Java)

October 2016


20

SonarQube and Continuous

Integration

October 2016


21

SonarQube and Jenkins

October 2016


22


October 2016


23


Running SonarQubeAnalyses:

– Sonar-Runner

– Maven

– Ant

Where?

– SonarQube analyses can be distributed.

– Jenkins and all the others CI systems allow for distributed execution of builds and build steps.

– The analyses should take place where the code is.

October 2016


24

Hands On the Platform…

October 2016


25

Processes

October 2016


26

Who does what?

All nowadays Integrated Development Environments (IDEs) like GNAT GPS 2016, Visual Studio 2013, Eclipse Luna, offer some form of Code Analysis.

October 2016


27

Who does what?

IDE’s analysis tools are to be used by software developers during their everyday work.

SonarQube analyses are more for the «quality people» and they are not supposed to be executed everyday, but rather at specific /well defined moments in the software development life cycle.

SonarQube analyses can also be used by software developers to:

– Execute project defined analyses

– Complement the IDE analysis capabilities

– Increase the “awareness” on the programing language (Educational)

October 2016


28

When?

SonarQube analyses should be performed after any «significant» delivery in a software development project, e.g. using ECSS 40 terminology, at:– CDR

– QR

– AR

In maintenance projects SonarQube analyses should be performed after any «significant» new delivery, e.g. supposing a versioning like:major.minor[.build[.revision]]After every «minor» delivery.

October 2016


29

Thank you for your time!

October 2016

Software

Spazio IT

SonarQube and Java - Spazio IT · SonarQube and Jenkins Running SonarQube Analyses: –Sonar-Runner...

Documents

Transcript of SonarQube and Java - Spazio IT · SonarQube and Jenkins Running SonarQube Analyses: –Sonar-Runner...