Upload
dmytro-patserkovskyi
View
78
Download
0
Embed Size (px)
Citation preview
Track code quality with SonarQube
HELLO!I am Dmytro Patserkovskyi
Project Manager and Founder of Dev SonarQube Community at V.I.Tech
Low code quality costs a lot
Toyota storyAug. 28, 2009, San Diego CA, USA
◉ Toyota reached 100 mph
◉ Phone call during event
◉ All 4 occupants killed in crash
◉ This is a trigger for Toyota investigation
Toyota story
NASA’s investigation found
7134 violations in code.
Oklahoma’s investigation found
81 514 violations in code.
Toyota story: Results◉ Recall of 10 000 000+ cars entire the world.
◉ Lost of billions dollars.
◉ 89 death till 2010 because of bugs.
Source Code Should BeSimple
& Readable
Extendable
Testable& Covered with Tests
Flexible
Code Metrics
Rules ViolationsCode Stylechecks if code compliant with conventions
Vulnerabilitiessearch for bottlenecks with lacks of validations, security issues etc
Bugslooking for bugs and potential bugs
Performance checks if everything doing in the best way
100% - rules compliance
Code Coverage
Line Coverage
Branch CoverageOverall Coverage
85% - min overall coverage
Cyclomatic Complexity
10 - max compliant complexity50 - function unsupported
DublicationsI SHALL
NOT DUPLICATE ANY CODE ANY CODE ANY CODE
!0% - perfect solution1% - keep buffer
Documentation
Code tells you what is doing, documentation should tell why and how.
JavaDocs Block Comments
100% - public documented API15% - comments in code
Technical Debt
Extra development work, that rises with not clear code.
Financial DEBT Time DEBT
An open source platform for
Continuous Inspection
20+ programming languages
50+ official plugins
Quality Rules and Profiles
Code Smells Bugs Vulnerabilities
Quality Profile
Rules Plugins and Repositories
44
53
357
43
73
Quality GatesSet of boolean conditions per project,
based on measure thresholds.
Passed
Warning
Failed
Quality GatesMetric Operator
Open Issues Is greater than 70 100
Blocker Issues Is greater than 0
Critical Issues Is greater than 0
New Issues Is greater than 0 10
Overall Coverage Is less than 85 80
Unit Test Failures Is greater than 0
Quality of New Code
Tracking quality of code, added in current snapshot
Comparison measures for different versions
Good for long term projects
Project DashboardIssues Coverage Complexity
Anything you wantAnother awesome widget
Duplications Documentation Useful Info
Code Processes
PullRequest
Master branch
Nightly
Each update
Support Team for SonarQube
Administrator
Sonar support and monitoring
Sonar upgrade (new version every 2 months)
Plugins upgrade (new version every month)
Dev Sonar Community
Working on Rules List
Updating Quality Profiles
Setting up Dashboards
Looking for new Plugins
Project Teams
Update project analysis frequently
Monitoring Quality of own project
Defining project Quality Gate
Voice and discuss all concerns with Sonar Community
Support Processes
ModificationsMonthly
MeetingsBiweekly
FeedbacksOn-demand
DiscussionsOn-demand
UpgradeMonthly
24/7 monitoring and transparency
Summary◉ Start from small: perform analysis
◉ Track code quality everyday
◉ Develop your own standard, or use existing
◉ Organize support process to make SonarQube alive
◉ Transparency 24/7, even for customers
Questions
THANKS!Resources◉ http://sonarqube.org◉ http://docs.sonarqube.org/display/PLUG/Plugin+Library◉ https://analysis.apache.org/
Links◉ https://facebook.com/dmytro.wng◉ http://slideshare.net/DmytroPatserkovskyi