IN ACTION G. Ann Campbell Patroklos P. Papapetrou FOREWORD BY Olivier Gaudin MANNING SonarQube in Action Download from Wow! eBook <www.wowebook.com> Download from Wow! eBook <www.wowebook.com> SonarQube in Action G. ANN CAMPBELL PATROKLOS P. PAPAPETROU MANNING SHELTER ISLAND Download from Wow! eBook <www.wowebook.com> For online information and ordering of this and other Manning books, please visit www.manning.com. The publisher offers discounts on this book when ordered in quantity. For more information, please contact Special Sales Department Manning Publications Co. 20 Baldwin Road PO Box 761 Shelter Island, NY 11964 Email: [email protected] ©2014 by Manning Publications Co. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in the book, and Manning Publications was aware of a trademark claim, the designations have been printed in initial caps or all caps. Recognizing the importance of preserving what has been written, it is Manning’s policy to have the books we publish printed on acid-free paper, and we exert our best efforts to that end. Recognizing also our responsibility to conserve the resources of our planet, Manning books are printed on paper that is at least 15 percent recycled and processed without the use of elemental chlorine. Manning Publications Co. Development editor: Susanna Kline 20 Baldwin Road Copyeditor: Tiffany Taylor PO Box 261 Proofreader: Toma Mulligan Shelter Island, NY 11964 Typesetter: Dottie Marsico Cover designer: Marija Tudor ISBN 9781617290954 Printed in the United States of America 1 2 3 4 5 6 7 8 9 10 – EBM – 18 17 16 15 14 13 Download from Wow! eBook <www.wowebook.com> To the software architects, programmers, testers, project managers, executives, and end users of every piece of software ever written. We hope this book will make your lives easier. Download from Wow! eBook <www.wowebook.com> Download from Wow! eBook <www.wowebook.com> brief contents PART 1 WHAT THE NUMBERS ARE TELLING YOU .........................1 1 ■ An introduction to SonarQube 3 2 ■ Issues and coding standards 26 3 ■ Ensuring that your code is doing things right 42 4 ■ Working with duplicate code 64 5 ■ Optimizing source code documentation 82 6 ■ Keeping your source code files elegant 96 7 ■ Improving your application design 113 PART 2 SETTLING IN WITH SONARQUBE ................................135 8 ■ Planning a strategy and expanding your insight 137 9 ■ Continuous Inspection with SonarQube 156 10 ■ Letting SonarQube drive code reviews 178 11 ■ IDE integration 205 PART 3 ADMINISTERING AND EXTENDING...............................221 12 ■ Security: users, groups, and roles 223 13 ■ Rule profile administration 237 14 ■ Making SonarQube fit your needs 262 15 ■ Managing your projects 287 16 ■ Writing your own plugin 305 vii Download from Wow! eBook <www.wowebook.com> Download from Wow! eBook <www.wowebook.com> contents foreword xvii preface xix acknowledgments xxi about this book xxiii about the cover illustration xxviii PART 1 WHAT THE NUMBERS ARE TELLING YOU ................1 An introduction to SonarQube 3 1 1.1 Why SonarQube 4 Proven technologies 6 ■ Multilingual: SonarQube speaks your language 6 1.2 Running your first analysis 7 Installation considerations 7 ■ Analyzing with SonarQube Runner 8 ■ Analyzing multilanguage projects 9 ■ Seeing the output: SonarQube’s front page 9 ■ Drilling in: the dashboard 10 1.3 Seven Axes of Quality 13 Potential bugs and coding rules 14 ■ Tests 15 ■ Comments and duplications 15 ■ Architecture and design 16 Complexity 18 1.4 The languages SonarQube covers 18 ix Download from Wow! eBook <www.wowebook.com> x CONTENTS 1.5 Interface conventions 20 Hierarchy: packages and classes in a metric drilldown 20 ■ File details 21 Trend arrows 22 1.6 Related plugins 23 Technical debt 23 ■ Views 24 1.7 Summary 24 Issues and coding standards 26 2 2.1 Looking at your issues 27 2.2 What issues mean, and why they’re potential problems 30 Bugs 31 ■ Potential bugs 31 ■ Indications of (potential) programmer error 32 ■ Things that may lead to future programmer error 34 ■ Inefficiencies 35 ■ Style inconsistencies (future productivity obstacles) 36 2.3 Where do issues come from? 36 Picking a rule profile 37 ■ Viewing profiles and changing the default 38 2.4 Related plugins 40 SCM Activity 40 2.5 Summary 41 Ensuring that your code is doing things right 42 3 3.1 Knowing how much of your code is doing things right 43 Understanding unit-test metrics 44 ■ Getting reports on unit-test coverage metrics 47 3.2 Explaining metrics on a file level 50 Hunting source code lines with low coverage 50 ■ Finding problems in your unit tests 54 3.3 Configuring your favorite code-coverage tool 57 Changing the default selection 57 3.4 Integration testing 58 Displaying integration testing coverage on the dashboard 59 Getting IT information in the source code Coverage tab 60 3.5 Related plugins 61 3.6 Summary 63 Download from Wow! eBook <www.wowebook.com> CONTENTS xi Working with duplicate code 64 4 4.1 The hidden cost of duplicate code 65 4.2 Identifying duplications 66 Finding your first duplication 67 ■ Finding duplications on a larger scale 69 ■ SonarQube’s duplication metrics 69 Drilling in: from the duplications widget to the Duplications tab 70 4.3 Realizing the impact of code duplication 73 The DRY principle: minimizing and eliminating duplications 73 Duplications vs. size and complexity 74 4.4 Finding duplications across multiple projects 74 Turning on cross-project duplication detection 75 ■ Cross-project duplications in source code tab 75 4.5 Cleaning up your duplications 77 Introduction to refactoring patterns 77 ■ Applying patterns to remove code duplication 77 ■ Time for a new commons library? 79 4.6 Related plugins 80 4.7 Summary 81 Optimizing source code documentation 82 5 5.1 To document or not? 83 5.2 Even commenting has its own metrics 84 How SonarQube calculates metrics 84 ■ What the numbers are telling you 86 5.3 Identifying undocumented code 87 Finding files to improve documentation 88 ■ Viewing the generic tab in the source code viewer 89 5.4 Simplifying your documentation strategy 90 Picking a documentation tool 90 ■ Defining a straightforward process 91 5.5 Related plugins 92 Widget Lab 93 ■ Doxygen 93 5.6 Summary 94 Download from Wow! eBook <www.wowebook.com> xii CONTENTS Keeping your source code files elegant 96 6 6.1 Keeping complexity low 97 Hunting those huge files 97 ■ Complexity: what it looks like and how to fix it 99 6.2 Lack of Cohesion of Methods: files that do too much 101 Getting reports about the LCOM metric 102 ■ Counting responsibilities 103 ■ Refactoring for fewer responsibilities 106 6.3 RFC and couplings: classes with too many friends 108 Response for Class 108 ■ Couplings 110 6.4 Summary 112 Improving your application design 113 7 7.1 Layering your code 114 Looking at dashboard widgets 114 ■ Understanding cycles and unwanted dependencies 115 ■ Moving from project to package level 117 7.2 Discovering dependencies and eliminating cycles 118 Navigating the Dependency Structure Matrix 119 ■ How the DSM works 121 ■ Identifying cycles 124 ■ Library management for Mavenites 127 ■ Browsing the library-dependency tree 127 Who uses this library 131 7.3 Defining your architectural rule set 132 7.4 Summary 134 PART 2 SETTLING IN WITH SONARQUBE ...................... 135 Planning a strategy and expanding your insight 137 8 8.1 Planning your strategy 138 Picking a metric 139 ■ Holding your ground 141 ■ Moving the goal posts 141 ■ Boy Scout approach: leave the class better than you found it 142 ■ SonarQube time: worst first 143 Re-architect 143 ■ The end game 144 8.2 History and trending 145 Time Machine 145 ■ Events and database cleanup 149 8.3 Everything’s a component 150 Project component view 150 ■ No package history 152 Download from Wow! eBook <www.wowebook.com> CONTENTS xiii 8.4 Related plugins 153 Tab Metrics 153 ■ Widget Lab 154 8.5 Summary 154 Continuous Inspection with SonarQube 156 9 9.1 Introducing Continuous Inspection 157 What and how? 157 ■ Life before and after Continuous Inspection 158 ■ The big picture 159 9.2 Triggering your analysis with CI 160 Jenkins setup 162 ■ Other CI systems 167 ■ Best practices 168 9.3 Monitoring quality evolution 169 Exploring differential views in the project dashboard 169 Differential views in the issues drilldown 172 ■ Differential views in the source code viewer 173 ■ Choosing differential periods 173 ■ The Compare service 174 9.4 Related plugins 175 Cutoff 175 ■ Build Breaker 176 9.5 Summary 177 Letting SonarQube drive code reviews 178 10 10.1 Reviewing code in SonarQube 179 Issues: a starting point 179 ■ Confirm, comment, and assign: the simplest workflow options 181 ■ False positives: sometimes SonarQube gets it wrong 183 ■ Changing severity: not every issue is that bad 186 ■ Altering the code to make SonarQube turn a blind eye 186 ■ Viewing the audit trail 188 10.2 Creating manual issues: when the rules aren’t enough 188 Why you would want extra issues 188 ■ Making manual issues 189 10.3 Tracking issues 190 Life cycle of an issue 190 ■ Tracking squashed issues 194 Searching issues 195 10.4 Planning your work with SonarQube’s action plans 196 Why bother with action plans? 196 ■ Managing action plans 196 ■ Using action