It has your back … by riding your back
Overview
SonarQube (abbreviated to Sonar here) improves quality by performing “static analysis” (scanning) of programming code to identify issues from meaures it calculates.
“Sonar’s power is as a way to reveal specific coding tricks the team might want to adopt.”
PROTIP: Introduce rules gradually and gently.
WARNING: Those who use Sonar purely as a surveillance tool to judge workers usually experience consequences.
CAUTION: Sonar stores code (in some compressed form) that it processes, which may be of security concern. Licenses are limited to the lines of code Sonar stores.
User Guide: https://docs.sonarqube.org/latest/user-guide/clean-as-you-code/
Static Analysis vs Lint
SonarQube’s licensed competitors include PRQA, which uses this illustration to differentiate itself versus lint programs and “bug catchers”.
The value proposition for using static analysis tools versus simpler lint programs is the time and frustration that developers save analyzing false positives, which leads to less usage and thus more lingering defects (“technical debt”).
A summary of what SonarQube finds estimates Technical Debt, which SonarQube tracks over time.
Sonar scans different facets (such as security).
Different languages
Sonar analyzes various languages using plug-ins.
### Sonar for Scala #
http://www.scalastyle.org/ provides a list of ways to use Scalastyle at https://github.com/scalastyle
by 3 people:
- Matthew Farwell (http://www.farwell.co.uk/ of Switzerland)
https://groups.google.com/forum/#!forum/scalastyle-users
https://github.com/emrehan/sonar-scalastyle
is based on a fork of https://github.com/NCR-CoDE/sonar-scalastyle
http://docs.codehaus.org/display/SONAR/Scala+Plugin
SQALE Summary Ratings
Sonar calculates a SQALE Rating based on the open-source SQALE (Software Quality Assessment based on Lifecycle Expectations) methodology defined by industry group http://www.sqale.org/. The caluculation is based on inclusion of rules set in the Common SonarQube repository:
- Duplicated blocks
- Failed unit tests
- Insufficient branch coverage by unit tests
- Insufficient comment density
- Insufficient line coverage by unit tests
- Skipped unit tests
Change SQUALE calculations in the plug-in http://www.sonarsource.com/products/plugins/governance/sqale/
Rules
SonarQube Analyzers scan code organized into projects.
Coding standards include:
-
ISO 26262
-
MISRA (Motor Industry Software Reliability Association) was first published in April 2013 to support C99 and C90 versions of the C language, used mostly for embedded software development.
-
JSF
-
HIC++
Tags
Customizable Tags provide a way to categorize and filter rules.
Install environment to Run SonarQube
Since SonarQube runs as a server, it’s best to have it run within a VM.
Upgrade to v7 involves a change to PostgreSQL or MariaDB from MySQL.
Install environment to Run SonarQube
-
Install SonarQube using Homebrew:
brew install scalastyle
This page was written after downloading file SonarQube 5.1.2 created Jul. 27, 2015 from http://www.sonarqube.org/
Most developers prefer to have Sonar look at code before commit into a team repository. Such preview mode runs do not store results in the Sonar run database.
Plugins enable Sonar to be invoked several ways:
-
From a command line as one step in local evaluations. This approach enables one-time parameter configuration for each individual user.
sonar-runner -
From inside IDE (IntelliJ, Eclipse, etc.) as part of code unit development and testing.
-
From a build server (Maven, Ant, MSBuild, etc.) as part of continuous integration/build.
The server uses Oracle or OpenSDK, which requires much more work https://github.com/hgomez/obuildfactory/wiki/Building-and-Packaging-OpenJDK7-for-OSX So please stay with Oracle for now.
MySQL is supported.
Docker and Puppet scripts to build the server ???
https://github.com/sonarsource/sonar-examples
- Read the documentation
- Unzip and start
- Analyze projects
- Ready to improve quality
Jenkins Configuration
Connection to Jenkins: http://docs.sonarqube.org/display/PLUG/SonarQube+Scanner+for+Jenkins
Client Configuration
http://www.sonarlint.org/visualstudio/ SonarLint for Visual Studio is based on and benefits from the .NET Compiler Platform (“Roslyn”) and its code analysis API to provide a fully-integrated user experience in Visual Studio 2015. SonarLint is free, open source, and available in the Visual Studio Gallery.
Validation
This article on July 2016 reported that researchers from NYU found that static scans found only 2% of defects injected by their PDF about their LAVA (Large-Scale Automated Vulnerability Addition).
This is both the fuzz testing” and “symbolic-execution” approaches.
Custom Rules
Write rules in Java to work on major languages, or XPATH to work on data formats (XML, PL/SQL, Flex) using the SSLR Toolkit.
https://docs.sonarqube.org/latest/extend/adding-coding-rules/
Each rule defines Impact and Likelihood assessments.
More on DevOps
This is one of a series on DevOps:
- DevOps_2.0
- ci-cd (Continuous Integration and Continuous Delivery)
- User Stories for DevOps
- Git and GitHub vs File Archival
- Git Commands and Statuses
- Git Commit, Tag, Push
- Git Utilities
- Data Security GitHub
- GitHub API
- Choices for DevOps Technologies
- Pulumi Infrastructure as Code (IaC)
- Java DevOps Workflow
- AWS DevOps (CodeCommit, CodePipeline, CodeDeploy)
- AWS server deployment options
- Cloud services comparisons (across vendors)
- Cloud regions (across vendors)
- Azure Cloud Onramp (Subscriptions, Portal GUI, CLI)
- Azure Certifications
- Azure Cloud Powershell
- Bash Windows using Microsoft’s WSL (Windows Subsystem for Linux)
- Azure Networking
- Azure Storage
- Azure Compute
- Digital Ocean
- Packer automation to build Vagrant images
- Terraform multi-cloud provisioning automation
-
Hashicorp Vault and Consul to generate and hold secrets
- Powershell Ecosystem
- Powershell on MacOS
- Jenkins Server Setup
- Jenkins Plug-ins
- Jenkins Freestyle jobs
- Docker (Glossary, Ecosystem, Certification)
- Make Makefile for Docker
- Docker Setup and run Bash shell script
- Bash coding
- Docker Setup
- Dockerize apps
- Ansible
- Kubernetes Operators
- Threat Modeling
- API Management Microsoft
- Scenarios for load
- Chaos Engineering