Now the question is, what are software characteristics? Well it could be:

  1. Whether the coding has been done following a specific convention
  2. Whether well-known/established good practices have been followed and well-known/established bad practices have been avoided
  3. Are there any potential bugs and performance issues, security vulnerabilities
  4. Is there any duplicate code
  5. Is the code logic very complex
  6. Whether the public API has good documentation and comments
  7. Whether the code has unit tests
  8. Whether the code follows good design and architecture principles

How do we define the corresponding attributes?

AttributeWeighted Value
Blocker5
Critical4
Major3
Minor2
Info1

After having the software characteristics defined, the next question which comes to our mind is how do we enforce it automatically? The answer lies in static code analysis.

Static code analysis is a collection of algorithms and techniques used to analyze source code in order to automatically find potential errors or poor coding practices. The idea is similar in spirit to compiler warnings (which can be useful for finding coding errors), but to take that idea a step further and find bugs that are traditionally found using run-time debugging techniques such as testing.

Sonarqube

Static code analysis, also commonly called 'white-box' testing, looks at applications in non-runtime environments. It is the only proven method to cover the entire code base and identify all the vulnerable patterns. Static code analysis is also considered as a way to automate code review process.

The tasks solved by static code analysis software can be divided into 3 categories:

There are many static analysis tools available. However, Checkstyle, PMD, and FindBugs are well-known and used in most of the projects

Checkstyle is an open source tool that can help enforce coding standards and best practices, with a particular focus on coding conventions. Checkstyle does cover some static code analysis features (in much the same way as PMD and Findbugs), however we will mainly concentrate on detecting and enforcing coding conventions with Checkstyle.

Main Focus: Conventions

PMD is a static code analysis tool capable of automatically detecting a wide range of potential defects and unsafe or non-optimized code (bad practices). Whereas other tools such as Checkstyle can verify that coding conventions and standards are respected, PMD focuses more on preemptive defect detection (ensuring good practices are followed). It comes with a rich and highly configurable set of rules, and you can easily configure which particular rules should be used for a given project.

The bad practices type consists of well-known behaviors that almost systematically lead to difficulties over time. Here are a few examples of bad practices:

Main Focus: Bad practices

FindBugs is another static analysis tool for Java, similar in some ways to Checkstyle and PMD, but with a quite different focus. FindBugs is not concerned in formatting or coding standards, and only marginally interested in best practices: in fact, it concentrates on detecting potential bugs and performance issues. It does a very good job of finding these, and can detect many types of common, hard-to-find bugs. Indeed, FindBugs is capable of detecting quite a different set of issues than PMD or Checkstyle with a relatively high degree of precision. As such, it can be a useful addition to your static analysis toolbox.

Main Focus: Potential Bugs

As per the HP Fortify website --

'HP Fortify Static Code Analyzer helps verify that your software is trustworthy, reduces costs, increases productivity, and implements secure coding best practices ...'

Key features

Main Focus : Security Vulnerabilities

SonarQube collects and analyzes source code, measuring quality and providing reports for your projects. It combines static and dynamic analysis tools and enables quality to be measured continuously over time. Everything that affects our code base, from minor styling details to critical design errors, is inspected and evaluated by SonarQube, thereby enabling developers to access and track code analysis data ranging from styling errors, potential bugs, and code defects to design inefficiencies, code duplication, lack of test coverage, and excess complexity. The Sonar platform analyzes source code from different aspects and hence it drills down to your code layer by layer, moving from the module level down to the class level. At each level, SonarQube produces metric values and statistics, revealing problematic areas in the source that require inspection or improvement.

Why SonarQube

You may wonder if SonarQube uses existing, proven, tools then why use it at all? You can just configure these tools as a plugin in the CI server and bang we will be done. Well not necessarily, well there are lots of caveats.

Features:

What makes SonarQube really stand out is that it not only provides metrics and statistics about your code, but translates these non-descript values to real business values such as risk and technical debt. SonarQube not only addresses core developers and programmers but, project managers and even higher managerial levels due to the management aspect it offers. This concept is further strengthened by SonarQube's enhanced reporting capabilities and multiple views addressing source code from different perspectives.

From a managerial perspective, transparent and continuous access on historical data enables the manager to ask the right questions.

Note: SonarQube is in no way competing with any of the above static analysis tools, but rather it complements and works very well with these tools. In fact, it ceases to work if these static analysis tools (Checkstyle, PMD, and FindBugs) do not exist. Further, we can integrate Fortify with SonarQube using this plugin.

References

Like This Article? Read More From DZone

sonarqube ,quality metrics ,code quality ,performance
Published at DZone with permission of Mohammad Nadeem , DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.