Integrating Static Code Analysis and Defect Tracking

MASARYK UNIVERSITY FACULTY}w¡¢£¤¥¦§¨ OF I !"#$%&'()+,-./012345<yA|NFORMATICS Integrating Static Code Analysis and Defect Tracking MASTER THESIS Jakub Papcun Brno, 2014 Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Supervisor: Ing. RNDr. Barbora Bühnová, Ph.D. iv Acknowledgements I would like to thank my supervisor, Barbora Bühnová, for providing valuable feedback and guidance. I would also like to thank Ronny Kolb, for his patient guidance and all the advice he gave me during whole work on the thesis. Last but not least I would like to thank all members of ACT team in Honeywell ACS in Brno for all their help and inputs to my thesis. v Abstract Static code analysis is a powerful way of improving the quality of source code. Using tools such as Klocwork, issues in source code can be automatically detected. Some of those issues represent defects injected during implementation activities or even during earlier development phases. These issues should be properly tracked and analyzed. The present thesis investigates on how to best integrate static code analysis and defect tracking with the goal of using static code analysis data for project tracking and continuous improvement of the development process used by teams in Honeywell ACS. The thesis includes the analysis of the state-of-the-art and state-of-the-practice regarding defect tracking from static code analysis tools. Based on the analysis features integrating Klocwork and Atlassian JIRA are implemented in the form of Atlassian JIRA plug-in. The implemented features are evaluated and future work on improvements and upgrades is proposed. vi Keywords Static Code Analysis, Defect Tracking, Klocwork, JIRA, Fisheye, Atlassian, Integration vii Contents 1 Introduction ......................................... 1 1.1 Context ......................................... 1 1.2 Goals .......................................... 1 1.3 Thesis Structure .................................... 2 2 State of the Art ....................................... 3 2.1 Code Quality ...................................... 3 2.1.1 Manual Code Review . 4 2.1.2 Static Code Analysis . 4 2.1.3 Dynamic Code Analysis . 5 2.2 Static Code Analysis ................................. 6 2.3 Defect Tracking .................................... 9 2.4 Defect Tracking of Static Code Analysis findings ................. 10 2.5 CMMI .......................................... 10 2.6 Conclusion ....................................... 11 3 State of the Practice ..................................... 12 3.1 ASDP and the UNITY project ............................ 12 3.2 Tools .......................................... 13 3.2.1 JIRA . 13 3.2.2 Klocwork . 14 3.2.3 Fisheye . 16 3.3 Code Quality and Static Code Analysis ...................... 16 3.4 Defect Tracking .................................... 18 3.5 Defect Tracking of Static Code Analysis Findings ................. 20 3.5.1 Proposed Features . 20 3.5.1.1 Create JIRA Defect from Klocwork Finding . 20 3.5.1.2 List of Klocwork Findings for Specific JIRA Issue . 21 3.5.1.3 Version Release Readiness Report . 21 4 Integration Feasibility Analysis ............................. 23 4.1 Overview ........................................ 23 4.2 Klocwork ........................................ 23 4.3 Fisheye ......................................... 25 4.4 Conclusion ....................................... 26 5 Integration Implementation ................................ 27 5.1 JIRA Plug-in structure ................................ 28 5.2 Klocwork and Fisheye Application Links ..................... 28 5.3 Mapping Klocwork Project, JIRA Project and Fisheye Project .......... 30 5.4 Creating Defect in JIRA from Klocwork ...................... 32 5.5 List of Klocwork findings for specific JIRA issues ................. 35 5.6 Version Release Readiness Report .......................... 38 6 Evaluation .......................................... 41 viii 6.1 First Round ...................................... 41 6.1.1 Method of Evaluation . 41 6.1.2 Scenarios . 41 6.1.3 Questions and Answers . 42 6.2 Second Round ..................................... 43 6.2.1 Method of Evaluation . 43 6.3 Conclusion ....................................... 44 7 Future Work ......................................... 45 8 Conclusion .......................................... 46 8.1 Contribution ...................................... 46 8.2 Summary ........................................ 46 Bibliography . 49 A JIRA Plug-in Installation and Configuration ...................... 50 A.1 JIRA Plug-in ...................................... 50 A.2 Python Installation .................................. 52 B Terms, acronyms and abbreviations ........................... 53 C Glossary ........................................... 54 D Contents of the attached archive ............................. 55 ix Chapter 1 Introduction 1.1 Context Honeywell is an international company that invents and manufactures a wide range of products and technologies. It employs over 130 000 employees in North and South America, Africa, Europe, Asia and Australia. The company is divided into four strategic business groups (SBGs). • Aerospace • Automation and Control Solutions (ACS) • Performance Materials and Technologies (PMT) • Transportation Systems (TS) Honeywell aims at implementation of Capability Maturity Model Integration (CMMI) level 5, described in more detail in Section 2.5, which requires putting a process compliant with CMMI into action across Honeywell ACS. As Section 2.5 describes, the goal of CMMI level 5 is continuous improvement of the processes and evaluation of the results across all the software development disciplines according to collected measurements and metrics. The work on the thesis was conducted in the ACS Center of Technologies (ACT). ACT is responsible, among others, for driving excellence across Honeywell ACS. The support and the deployment of ACS Software Development Process (ASDP) described in detail in Section 3.1 is defined as one of its responsibilities. ACT’s role also includes developing best practices, coaching and mentoring of other teams across Honeywell ACS. Further, ACT sup- ports tools recommended for software development activities. Development of extensions for these tools is one of the major activities of ACT in Brno. 1.2 Goals The goal of this thesis is to find a way to decrease the development cycle time by integrating some of the tools used for software development across Honeywell ACS, specifically Klocwork Insight (Klocwork) and Atlassian JIRA. This integration should help the develop- ers save time during their development activities as well as code quality of their developed software products. 1 1.3. THESIS STRUCTURE The outcome of this thesis should be a set of features integrating Klocwork with JIRA in the form of a plug-in for Atlassian JIRA. 1.3 Thesis Structure The thesis is further divided into the following seven chapters. Chapter 2 State of the Art provides an overview of Code Quality as an important part of software development and ways to ensure high quality of the code of a product. It also describes Defect Tracking and existing solutions of Static Code Analysis and Defect Tracking integration. Chapter 3 State of the Practice describes the use of Static Code Analysis and Defect Track- ing within Honeywell ACS. It discusses possibilities of the integration of the two activities and introduces ideas for the implementation of new features for future use by teams across Honeywell ACS. Chapter 4 Feasibility Analysis discusses the possibility of the integration between Kloc- work and JIRA, capabilities of both tools, draws conclusions, and creates solutions for issues the integration would have to deal with during the implementation. Chapter 5 Implementation deals with the implementation itself. It describes each implemented feature, open issues the features still deal with due to various factors, and the re- sulting products of the implementation. Chapter 6 Evaluation describes the methodology of evaluating the results of this thesis and results gathered from users that evaluated the implemented features on their own project. Chapter 7 Future Work suggests feature improvements, upgrades, and ideas for new features to be implemented as part of the integration. Chapter 8 Conclusion evaluates the goals fulfillment and summarizes the outputs of the thesis. 2 Chapter 2 State of the Art This chapter introduces code quality and the ways of code quality assurance such as Man- ual Code Review, Dynamic Code Analysis and Static Code Analysis. It describes Defect Tracking, another established part of software development and discusses possibilities of integration of Static Code Analysis and Defect Tracking. 2.1 Code Quality According to ISO/IEC 9126 specification, quality of the software depends on several char- acteristics [1] such as • functionality — capability of the software to provide functions which meet stated needs when the software is used under stated conditions, • reliability — capability of software product to maintain a specified level of performance when used under specified conditions, • usability — the capability of the software product to be understood, learned, used and attractive to the user, when used under specified conditions, • efficiency — the capability

Load more