SonarQube 5.1. Code Analysis Study. Study. Version: 1.0 Status from: :09:00 Status: Draft Author: Karin Zölzer

Transcription

1 SonarQube 5.1 Code Analysis Study Study Version: 1.0 Status from: :09:00 Status: Draft Author: Karin Zölzer Document-ID: Classification: Internal Software Quality Lab. SWQL-SonarQube Alle Rechte vorbehalten. Druckdatum:

2 Contents DOCUMENT INFORMATION... III General... III Document-History... III Dokument-Qualitätssicherung... III Purpose and contents of this document... III 1. INTRODUCTION Components CONFIGURATION Requirements Quick analysis with SonarQube Runner Install and configure SonarQube Java environment Integration in.net environment Plugins ANALYSIS Web frontend Seven Axes of Quality Bugs and potential bugs Coding standards Code duplications Test coverage Complexity Architecture and design Comments Technical debt Quality gates Differential Views Reporting Tags Issue review CONCLUSION REFERENCES Version: 1.0 vom Author: Karin Zölzer Status: Draft I / III

3 APPENDIX List of Pictures Version: 1.0 vom Author: Karin Zölzer Status: Draft II / III

4 Document information General Relation to other documents: This document is a part of the Unit Test Study by Software Quality Lab. Distribution: Document-History Version Status Date Responsible Person Reason for change / Notes Dokument-Qualitätssicherung Role Name Availability: (Org.+Tel.+ ) Activity Date Signature Author Karin Zölzer created Reviewer Jürgen Plasser reviewed Release Jürgen Plasser released Purpose and contents of this document This document contains an objective analysis of a chosen code analysis tool and should serve as a decision support in the process of acquiring a new code analysis tool. Version: 1.0 vom Author: Karin Zölzer Status: Draft III / III

5 1. Introduction SonarQube is an open source platform for continuous code inspection and management of code quality. It analyzes the source code with respect to different quality measures. The results are presented on a web interface. It is platform independent and published under the GNU LGPLv3 license. SonarQube itself is implemented in Java, but supports over 20 languages, including C#, C/C++, JavaScript, PHP, Python and ABAP. Those languages can be included as plugins. Most of them are freely available, however some are commercial. A number of additional plugins are offered for integrating SonarQube into your IDE and CI server. Since version 4.5 SonarQube also provides long term support versions Components In general, SonarQube consists of three components: 1. A webserver to provide the web frontend for the user to view results and configure SonarQube. 2. An external database for storing SonarQube configuration properties as well as code quality analysis snapshots. 3. Analyzers that perform the code analysis. There are different analyzer available, e.g. for Maven, Ant or Gradle projects. Picture 1: SonarQube components Technically it is not mandatory to install a third party database since SonarQube has an embedded database. However this should be only used for evaluation purposes. Please note that the embedded database does not scale and does not support data migration into a different database system or upgrading to a newer version. Version: 1.0 vom Autor: Karin Zölzer Status: Draft 1 / 28

6 2. Configuration 2.1. Requirements For the recent SonarQube version (5.1.2) the following system requirements are a prerequisite. The web server requires at least 1 GB RAM to run efficiently. Required disk space depends on the amount of code that is analyzed. The following platforms are supported by SonarQube 4.5: Java platform o Oracle JRE 7, 8 o OpenJDK 7, 8 Databases o Microsoft SQL Server 9.0 and 10.0 with bundled jtds driver (Microsoft drivers are not supported, only Express Edition) o Microsoft SQL Server 11.0 support is scheduled for Q o MySQL o Oracle 11G, 12C, XE Editions o PostgreSQL 8.x 9.x Web Browser: IE 9 11, Mozilla Firefox, Google Chrome, Safari 2.2. Quick analysis with SonarQube Runner This section demonstrates how you can quickly analyze a project. For this purpose the SonarQube Runner (which is the default analyzer) will be used as a simple command-line tool for analyzing source code. The following steps are necessary to analyze a simple project: 1. Download and unzip the current SonarQube distribution and the SonarQube Runner 1 2. Start the SonarQube server by executing StartSonar.bat (for windows user) or sonar.sh (for other operating systems). These files an located in the bin/<os> folder. E.g. for starting the server on a Windows 64 host execute: # change to SonarQube directory > bin/windows-x86-64/startsonar.bat 3. Analyze a project 2 by executing the SonarQube Runner in the project root directory. # change to project directory > <path to sonar runner>/bin/sonar-runner.bat 4. After successful execution the result for the analyzed project is available at Project samples (for different languages) can be found at Version: 1.0 vom Autor: Karin Zölzer Status: Draft 2 / 28

7 Picture 2: Result of a simple Java project analyzed with SonarQube Runner 2.3. Install and configure SonarQube This section demonstrates how to integrate SonarQube in existing project environments. We integrate SonarQube in both, a Java and a.net environment with continuous integration. Our goals are as followed: User management should not be done manually; we want to use our existing user base for authentication and authorization in SonarQube. Synchronization should be done automatically. The static code analysis should be conducted as a build step. Issues should be communicated back to the developer and displayed in the IDE. Version: 1.0 vom Autor: Karin Zölzer Status: Draft 3 / 28

8 Picture 3: Continuous code inspection scenario The following tools have been used: SonarQube o LDAP Plugin 1.4 PostgreSQL Java environment o Jenkins with Sonar plugin o Visual SVN Server o Eclipse Luna with SonarQube plugin 3.5 o SonarQube Runner 2.4.NET environment o SonarQube C# plugin 4.2 o SonarQube Runner for MSBuild 1.01 o Team Foundation Server 2015 o Visual Studio 2015 with VSSonar Extension Set up a database: Create empty schema and a user for SonarQube who is granted permissions to create, update and delete objects for this schema. Depending on the DBMS you use, some custom settings are necessary. Those can be found in the database installation guide Configure SonarQube: a. Download and unzip the SonarQube distribution Version: 1.0 vom Autor: Karin Zölzer Status: Draft 4 / 28

9 Thank you very much for downloading a public preview of our well known and highly appreciated tool studies. If you re interested in reading the whole document just apply here and request the document you want to read from our comprehensive set of studies already available. For further information on our tool studies visit our web site. Or, you can always use the following form to request the studies you want to read. Seite 1 von 2

10 Bestellformular für Tool-Studien/Order form for tool studies An/to Software Quality Lab GmbH Gewerbepark Urfahr Linz AUSTRIA Bitte ausgefüllt per an/ Please fill out and send to info@software-quality-lab.com Name/full name: Adresse/address: Firma/company: / Funktion/role: Telefon/phone: / [bitte füllen Sie die Daten vollständig und korrekt aus/please supply correct and complete data] Bestellliste/Order list [bitte kreuzen Sie die gewünschten Tools an/please select the tool studies] ALM, RM IBM Rational Requirements Composer Jama Contour 3.61 NEU! Micro Focus Borland Caliber Microsoft Team Foundation Server 2013 Polarion ALM 2014 HP ALM 11 VersioneOne 13.0 Visure Solutions IRQA 4 Test Management Imbus TestBench Micro Focus SilkCentral 2008 Microsoft VSTS 2010 Mozilla Testopia 2.1 Orcanos QPack 5 Polarion ALM NEU! Siemens SiTEMPPO 5.8 TestLink Seapine TestTrack 2012 Static Code Analysis SonarQube 4.5 GUI Test Automation Appium Bredex GUIdancer 4.2 HP UFT Professional 10 IBM Functional Tester Microsoft VSTS 2010 QF-Test NEU! Ranorex 3.3 SAP ecatt Selenium 2.0 SmartBear TestComplete 9.3 SmartBear SoapUI 5.1 Weitere Informationen auf unserer Website Embedded Systems LDRA 8.0 Razorcat Tessy 2.6 Load/Performance Apache JMeter 2.8 Grinder 3.4 HP LoadRunner 9.5 Neotys Neoload SmartBear LoadUI Unit Tests Google Test 1.5 JUnit 4.11 NUnit Die Toolnamen und eingetragenen Warenzeichen sind Eigentum der jeweiligen Toolhersteller/Tool names are property of tool vendors. Die Studien sind grundsätzlich auf Anfrage frei erhältlich. Software Quality Lab behält sich jedoch vor, die Aufwände für gewisse Branchen und Privatpersonen in Rechnung zu stellen (z.b. Beratungsfirmen, Toolhersteller usw.) Studenten erhalten die Studie zum halben Preis/All studies are basically free, except for certain branches of industry or private persons, for whom we invoice at cost. Students get a discount of 50%. Seite 2 von 2

11 Tool Evaluation Center Efficient, goal-oriented and professional tool evaluation Unique in Europe What is TEC? The Tool Evaluation Center (TEC) is a neutral environment for evaluating software tools related to software development, through which you will receive a detailed, vendorindependent overview of the suitability of different tools for your software projects. Your Partner for software quality and testing Consulting Implementation Training Automation Evaluation Software Quality Lab is your competent partner in software quality and testing and one of the leading independent consulting companies in Austria. We specialize ourselves in the improvement of efficiency, quality and security in the fields of software development and system processes. All tools in TEC are up to date, installed and configured, furnished with examples and ready for demonstration. Practical work and getting to know the tools in a handson manner is also possible. Your Benefit EETime-saving: Tool selection in a few days. No time-consuming research and product requests, no installation and testing. EEPreparation of information for different target groups from technicians to the managing board. EESupport provided by specialists, ranging from requirements through to a proof of concept or a pilot project. Our services around the tool selection Tool categories in the TEC EEApplication Life Cycle Management EERequirements Management EETest Management EEGUI Test Automation EETest Data Management EEComprehensible decision criteria: Using special techniques we evaluate the tools together with you, basing on your requirements as a foundation for your investment decision. EELarge selection and direct comparison of products ranging from market leaders through newcomers to open source software and freeware. Linz / Vienna / Graz / Lustenau / Munich Requirements elicitation, Creating a list of criteria Tool review, Pre-selection of tools, Practical getting to know the tools in the TEC Workshop with 3-5 suitable tools, Proof of Concept, Planning and implementing the pilot project Integration with other tools Tools in TEC Our TEC includes more then 40 installed tools from reputable manufacturer (e.g. IBM, HP, Micro Focus, Microsoft, Polarion, Siemens) as well as interesting newcomer products and alternatives from the open source area (e.g. JMeter, Selenium). Further details can be found at V Software Quality Lab GmbH info@software-quality-lab.com