Beyond the Basics of SonarQube

Beyond the basics of
SonarQube
Improve your
Java(Script) even
further
Johan Janssen (Info Support) @johanjanssen42
Agenda
 SonarQube basic features
 Analyzing data
 Code review
 Hunting bad design and architecture
 Testing
 Other languages
 Plugins
 Using SonarQube on existing projects
 Tips / summary
 Questions
Quality for thousands of years
Quality after years of improvements
Quality for 39 days
Bugs
 Microsoft Applications: "about 10 - 20
defects per 1000 lines of code during in-
house testing,
and 0.5 defect per 1000 lines of code in
released product (Dave Moore 1992).“
Bugs
 NASA's Spirit rover became unresponsive
on January 21, 2004, a few weeks after
landing on Mars. (Wikipedia)
 In January 2009, Google's search engine

erroneously notified users that every web
site world wide was potentially malicious,
including its own. (Wikipedia)
Find them as fast as possible
Why should I use SonarQube?
 I’m told to use it.
 We need to achieve certain results (SIG…)
 I want to improve my coding standards
SonarQube
 Platform to manage code quality
 Open source, possible to pay for support
and some plugins
 Since 2006; now they have 200 customers
and SonarQube is used in 15.000
organizations
 Active community: support, plugins, books
SonarQube
2013:
 5 releases of SonarQube platform
 130 releases of ecosystem products
 75,000 downloads of SonarQube
 13,000+ messages on mailing lists
SonarQube architecture
SonarQube basic features
Dashboard with ‘time changes’
Configure dashboards
Configure dashboards
Quality Gates
Notifications
Analysing data
Compare
Measures
Measure Filter as Bubble Chart
Filter Motion Chart
What is good code?
Code review
Roles
Add code review
Why code reviews?
“We all need people who will give us

feedback. That's how we improve.”
- Bill Gates
Hunting bad design and architecture
Hunting bad design and architecture
Architectural constraints
Architectural constraints
Package tangle index
Package tangle index
Testing
Now manual execution of unit tests
mvn clean install

mvn sonar:sonar
mvn clean org.jacoco:jacoco-maven-

plugin:prepare-agent install
-Dmaven.test.failure.ignore=true
mvn sonar:sonar
Coverage per test
Coverage per test
 Configure the POM (see next slide)
 Activate profile to get coverage per test
information
mvn org.jacoco:jacoco-maven-
plugin:prepare-agent
clean
install -Pcoverage-per-
test
 Analyze the project
mvn sonar:sonar
Coverage per test workspace
Integration testing
Integration testing
 Add integration test coverage widget to
SonarQube
 Download Jacoco agent
 Configuration for Tomcat’s catalina.bat:
set JACOCO=-javaagent:$path$\lib\
jacocoagent.jar,
destfile=$resultpath$\jacoco.exec,
append=false,includes=com.dockerpi.*
set JAVA_OPTS=%JAVA_OPTS% %JACOCO%
Integration testing
 Start Tomcat
 Execute tests (manual, integration,
performance…)
 Stop Tomcat and execute SonarQube
analysis
mvn clean install sonar:sonar
-
Dsonar.dynamicAnalysis=reuseReports
-Dsonar.jacoco.itReportPath=
$resultpath$\jacoco.exec
Unit and integration testing
combined
PMD rules for unit testing
Other languages
JavaScript
JavaScript
CSS
CSS
Web plugin
Plugins
Pitest plugin
Pitest plugin
 Enable ‘Survived mutant’ rule in
SonarQube Quality Profile
 Configure Pitest for instance with Maven
(see next slides)
Pitest plugin
 Execute tests and send results to
SonarQube
mvn org.pitest:pitest-
maven:mutationCoverage
mvn sonar:sonar
-Dsonar.pitest.mode=reuseReport
Pitest plugin
 Maven configuration inside the build/plugins
section
<plugin>
<groupId>org.pitest</groupId>
<artifactId>pitest-maven</artifactId>
<version>LATEST</version>
<configuration>
<inScopeClasses>
<param>com.example*</param>
</inScopeClasses>
<targetClasses>
<param>com.example*</param>
</targetClasses>
<outputFormats>
<outputFormat>XML</outputFormat>
</outputFormats>
</configuration>
Pitest plugin
Build breaker plugin
[INFO] [15:15:57.671] Executing post-job class
org.sonar.plugins.buildbreaker.AlertBreaker
[ERROR] [15:15:57.673] [BUILD BREAKER] Coverage < 80
[ERROR] [15:15:57.673] [BUILD BREAKER] Critical issues > 0
[ERROR] [15:15:57.673] [BUILD BREAKER] Major issues > 0
[ERROR] Alert thresholds have been hit (3 times).
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 8.169s
[INFO] Finished at: Sat Aug 30 15:15:57 CEST 2014
[INFO] Final Memory: 21M/234M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.codehaus.mojo:sonar-maven-
plugin:2.4:sonar (default-cli) on project DockerPiExample: Alert thresholds
have been hit (3 times)
(Eclipse) IDE integration
 Supports incremental analyses (default)
 Install plugin through Eclipse Marketplace
 Configure SonarQube server:
o Window -> Preferences -> SonarQube -
> Servers
o Right click on your project in the Project
Explorer
o Configure -> Associate with SonarQube
Eclipse SonarQube Issues
Eclipse SonarQube Issues Editor
Eclipse SonarQube Web Browser
SCM Activity plugin
Build Stability plugin
Build Stability plugin
Tab metrics plugin
Mojo Bridge Plugin (Development)
Mojo Bridge Plugin (Development)
Leftovers
Libraries
Branches
 mvn sonar:sonar -
Dsonar.branch=4.4
Exclusions
 Ignore files
 Ignore issues
 Ignore duplications
 Ignore code coverage
 Example:
mvn sonar:sonar -Dsonar.exclusions=

src/main/webapp/lib/*.js
Duplications across projects
Duplications across projects
Complexity
Technical debt pyramid
Using SonarQube on existing
projects
projects
projects
 Identity hotspots
 Use action plans
 Maybe use a less strict quality profile
 Add tasks/stories in the sprint to improve
quality
 Monitor quality of new code.
o Cutoff plugin
Hotspots
Planning issues
Issues
Tips for using SonarQube in a project
 Create stories/tasks to improve the quality

 Perform manual code reviews
 Agree on a standard for items SonarQube
cannot check
 Fix items or mark them as false positive
 Use separate logins
 Settings/reviews are project specific
Tips for using SonarQube in a project
 Options to use SonarQube

o Central server (commit AND nightly)
o IDE plugin (for instance Eclipse plugin)
o Local in your development environment
 Check code quality before ‘To verify’ step

o First merge your code so it is up to date
 Verifier should also verify the quality
Accept failure, but improve
continuously
“Once we accept our limits, we go beyond

them.”
- Albert Einstein
Questions
 Ask me!
 SonarQube dev /user mailinglist
 Sonarqube.org
 Nemo example dashboard
 SonarQube books
johan.janssen@infosupport.com
@johanjanssen42

Beyond the Basics of SonarQube

Uploaded by

Copyright:

Available Formats

Beyond the Basics of SonarQube

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Beyond the Basics of SonarQube

Uploaded by

Copyright:

Available Formats

Beyond the basics of

 In January 2009, Google's search engine

“We all need people who will give us

mvn clean install

mvn clean org.jacoco:jacoco-maven-

mvn sonar:sonar -Dsonar.exclusions=

 Create stories/tasks to improve the quality

 Options to use SonarQube

 Check code quality before ‘To verify’ step

“Once we accept our limits, we go beyond

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.