Track code quality

with SonarQube
 HELLO!
I am Dmytro Patserkovskyi
Project Manager and Founder
of Dev SonarQube Community at V.I.Tech
Low code quality costs a lot
 Toyota story
Aug. 28, 2009, San Diego CA, USA

◉ Toyota reached 100 mph

◉ Phone call during event

◉ All 4 occupants killed in crash

◉ This is a trigger for Toyota investigation

Toyota story

NASA’s investigation found

7134 violations in code.

Oklahoma’s investigation found

81 514 violations in code.
 Toyota story: Results
◉ Recall of 10 000 000+ cars entire the world.

◉ Lost of billions dollars.

◉ 89 death till 2010 because of bugs.

 Source Code Should Be
Simple Flexible
& Readable

Testable
Extendable & Covered with Tests
Code Metrics
 Rules Violations
Code Style Bugs
checks if code compliant looking for bugs and
with conventions potential bugs

Performance
checks if everything
Vulnerabilities doing in the best way
search for bottlenecks
with lacks of validations,
security issues etc 100% - rules compliance
 Code Coverage
Overall Coverage
Branch Coverage

Line Coverage 85% - min overall coverage

Cyclomatic Complexity

10 - max compliant complexity

50 - function unsupported
 Dublications

!
I SHALL
NOT
DUPLICAT 0% - perfect solution

E ANY
1% - keep buffer

CODE ANY
 Documentation

Block 100% - public documented API

JavaDocs
Comments 15% - comments in code

Code tells you what is doing,

documentation should tell why and how.
 Technical Debt

Extra development work,

that rises with not clear code.

Financial DEBT Time DEBT

An open source platform for
Continuous Inspection
20+ programming languages

50+ official plugins

 Quality Rules and Profiles

Code Smells Bugs Vulnerabilities

Quality Profile
 Rules Plugins and Repositories

44 357
73

53
43
 Quality Gates
Set of boolean conditions per project,
based on measure thresholds.

Passed
Warning

Failed
 Quality Gates
Metric Operator
Open Issues Is greater than 70 100
Blocker Issues Is greater than 0
Critical Issues Is greater than 0
New Issues Is greater than 0 10
Overall Coverage Is less than 85 80
Unit Test Failures Is greater than 0
 Quality of New Code

Tracking quality of code, added in current snapshot

Comparison measures for different versions

Good for long term projects

 Project Dashboard
Issues Coverage Complexity

Duplications Documentation Useful Info

Another awesome widget Anything you want

Code Processes

Each update
PullRequest

Nightly

Master branch
Support Team for SonarQube
 Administrator

Sonar support and monitoring

Sonar upgrade (new version every 2 months)

Plugins upgrade (new version every month)

 Dev Sonar Community

Working on Rules List

Updating Quality Profiles

Setting up Dashboards

Looking for new Plugins

 Project Teams

Update project analysis frequently

Monitoring Quality of own project

Defining project Quality Gate

Voice and discuss all concerns with Sonar Community

Support Processes
Meetings
Biweekly
Discussions
On-demand

Upgrade
Monthly
Modifications Feedbacks
Monthly On-demand
24/7 monitoring and transparency
 Summary
◉ Start from small: perform analysis
◉ Track code quality everyday
◉ Develop your own standard, or use existing
◉ Organize support process to make SonarQube alive
◉ Transparency 24/7, even for customers
Questions
 THANKS!
Resources
◉ http://sonarqube.org
◉ http://docs.sonarqube.org/display/PLUG/Plugin+Library
◉ https://analysis.apache.org/

Links
◉ https://facebook.com/dmytro.wng
◉ http://slideshare.net/DmytroPatserkovskyi